{
  "statistics": {
    "processing": [
      {
        "name": "CAPE",
        "time": 4.914
      },
      {
        "name": "AnalysisInfo",
        "time": 0.045
      },
      {
        "name": "BehaviorAnalysis",
        "time": 0.588
      },
      {
        "name": "Debug",
        "time": 0.001
      },
      {
        "name": "NetworkAnalysis",
        "time": 0.0
      },
      {
        "name": "UrlAnalysis",
        "time": 1.713
      },
      {
        "name": "script_log_processing",
        "time": 0.001
      },
      {
        "name": "ProcessMemory",
        "time": 0.0
      }
    ],
    "signatures": [
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "stealth_network",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_blocklist",
        "time": 0.0
      },
      {
        "name": "disable_driver_via_hvcidisallowedimages",
        "time": 0.0
      },
      {
        "name": "disable_hypervisor_protected_code_integrity",
        "time": 0.0
      },
      {
        "name": "pendingfilerenameoperations_Operations",
        "time": 0.0
      },
      {
        "name": "anomalous_deletefile",
        "time": 0.0
      },
      {
        "name": "antiav_360_libs",
        "time": 0.0
      },
      {
        "name": "antiav_ahnlab_libs",
        "time": 0.0
      },
      {
        "name": "antiav_avast_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bitdefender_libs",
        "time": 0.0
      },
      {
        "name": "antiav_bullguard_libs",
        "time": 0.0
      },
      {
        "name": "antiav_emsisoft_libs",
        "time": 0.0
      },
      {
        "name": "antiav_qurb_libs",
        "time": 0.0
      },
      {
        "name": "antiav_servicestop",
        "time": 0.0
      },
      {
        "name": "antiav_apioverride_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_guardpages",
        "time": 0.0
      },
      {
        "name": "antidebug_ntcreatethreadex",
        "time": 0.0
      },
      {
        "name": "antiav_nthookengine_libs",
        "time": 0.0
      },
      {
        "name": "antidebug_outputdebugstring",
        "time": 0.0
      },
      {
        "name": "antidebug_setunhandledexceptionfilter",
        "time": 0.0
      },
      {
        "name": "antidebug_windows",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_func",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoo",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoocrash",
        "time": 0.0
      },
      {
        "name": "antisandbox_foregroundwindows",
        "time": 0.0
      },
      {
        "name": "mouse_movement_detect",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_objects",
        "time": 0.0
      },
      {
        "name": "antisandbox_script_timer",
        "time": 0.0
      },
      {
        "name": "antisandbox_sleep",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_libs",
        "time": 0.0
      },
      {
        "name": "antisandbox_unhook",
        "time": 0.0
      },
      {
        "name": "hardware_id_profiling",
        "time": 0.0
      },
      {
        "name": "antivm_directory_objects",
        "time": 0.0
      },
      {
        "name": "antivm_display",
        "time": 0.0
      },
      {
        "name": "antivm_generic_disk",
        "time": 0.0
      },
      {
        "name": "antivm_generic_scsi",
        "time": 0.0
      },
      {
        "name": "antivm_generic_services",
        "time": 0.0
      },
      {
        "name": "antivm_generic_system",
        "time": 0.0
      },
      {
        "name": "antivm_checks_available_memory",
        "time": 0.0
      },
      {
        "name": "detect_virtualization_via_recent_files",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_libs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_window",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_events",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_libs",
        "time": 0.0
      },
      {
        "name": "antivm_wmi",
        "time": 0.0
      },
      {
        "name": "api_spamming",
        "time": 0.0
      },
      {
        "name": "api_uuidfromstringa",
        "time": 0.0
      },
      {
        "name": "bcdedit_command",
        "time": 0.0
      },
      {
        "name": "bootkit",
        "time": 0.0
      },
      {
        "name": "direct_hdd_access",
        "time": 0.0
      },
      {
        "name": "physical_drive_access",
        "time": 0.0
      },
      {
        "name": "potential_overwrite_mbr",
        "time": 0.0
      },
      {
        "name": "read_file_raw_disk_access",
        "time": 0.0
      },
      {
        "name": "suspicious_iocontrol_codes",
        "time": 0.0
      },
      {
        "name": "browser_needed",
        "time": 0.0
      },
      {
        "name": "firefox_disables_process_tab",
        "time": 0.0
      },
      {
        "name": "amsi_enumeration",
        "time": 0.0
      },
      {
        "name": "regsvr32_squiblydoo_dll_load",
        "time": 0.0
      },
      {
        "name": "suspicious_ntdll_disk_load",
        "time": 0.0
      },
      {
        "name": "direct_syscall_evasion",
        "time": 0.0
      },
      {
        "name": "unbacked_syscall_execution",
        "time": 0.0
      },
      {
        "name": "uac_bypass_cmstp",
        "time": 0.0
      },
      {
        "name": "uac_bypass_eventvwr",
        "time": 0.0
      },
      {
        "name": "uac_bypass_windows_Backup",
        "time": 0.0
      },
      {
        "name": "privilege_elevation_check",
        "time": 0.0
      },
      {
        "name": "queries_computer_name",
        "time": 0.0
      },
      {
        "name": "queries_user_name",
        "time": 0.0
      },
      {
        "name": "creates_largekey",
        "time": 0.0
      },
      {
        "name": "creates_nullvalue",
        "time": 0.0
      },
      {
        "name": "access_windows_passwords_vault",
        "time": 0.0
      },
      {
        "name": "dump_lsa_via_windows_error_reporting",
        "time": 0.0
      },
      {
        "name": "lsass_credential_dumping",
        "time": 0.0
      },
      {
        "name": "critical_process",
        "time": 0.0
      },
      {
        "name": "query_fips_reconnaissance",
        "time": 0.0
      },
      {
        "name": "cryptopool_domains",
        "time": 0.0
      },
      {
        "name": "dead_connect",
        "time": 0.0
      },
      {
        "name": "dead_link",
        "time": 0.0
      },
      {
        "name": "debugs_self",
        "time": 0.0
      },
      {
        "name": "decoy_image",
        "time": 0.0
      },
      {
        "name": "deletes_consolehost_history",
        "time": 0.0
      },
      {
        "name": "deletes_self",
        "time": 0.0
      },
      {
        "name": "deletes_shadow_copies",
        "time": 0.0
      },
      {
        "name": "deletes_system_state_backup",
        "time": 0.0
      },
      {
        "name": "dep_bypass",
        "time": 0.0
      },
      {
        "name": "dep_disable",
        "time": 0.0
      },
      {
        "name": "disables_mappeddrives_autodisconnect",
        "time": 0.0
      },
      {
        "name": "disables_spdy",
        "time": 0.0
      },
      {
        "name": "disables_wfp",
        "time": 0.0
      },
      {
        "name": "add_windows_defender_exclusions",
        "time": 0.0
      },
      {
        "name": "mountpoints_volume_discovery",
        "time": 0.0
      },
      {
        "name": "dll_load_uncommon_file_types",
        "time": 0.0
      },
      {
        "name": "dllload_suspicious_directory",
        "time": 0.0
      },
      {
        "name": "document_script_exe_drop",
        "time": 0.0
      },
      {
        "name": "driver_load",
        "time": 0.0
      },
      {
        "name": "install_kernel_driver_service",
        "time": 0.0
      },
      {
        "name": "malformed_dll_loading",
        "time": 0.0
      },
      {
        "name": "dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "registers_vectored_exception_handler",
        "time": 0.0
      },
      {
        "name": "exec_crash",
        "time": 0.0
      },
      {
        "name": "process_creation_suspicious_location",
        "time": 0.0
      },
      {
        "name": "exploit_getbasekerneladdress",
        "time": 0.0
      },
      {
        "name": "exploit_gethaldispatchtable",
        "time": 0.0
      },
      {
        "name": "exploit_heapspray",
        "time": 0.0
      },
      {
        "name": "downloads_from_filehosting",
        "time": 0.0
      },
      {
        "name": "generic_phish",
        "time": 0.0
      },
      {
        "name": "http_request",
        "time": 0.0
      },
      {
        "name": "infostealer_browser",
        "time": 0.0
      },
      {
        "name": "infostealer_browser_password",
        "time": 0.0
      },
      {
        "name": "infostealer_cookies",
        "time": 0.0
      },
      {
        "name": "captures_screenshot",
        "time": 0.0
      },
      {
        "name": "injection_createremotethread",
        "time": 0.0
      },
      {
        "name": "creates_suspended_process",
        "time": 0.0
      },
      {
        "name": "injection_explorer",
        "time": 0.0
      },
      {
        "name": "injection_module_stomping_probing",
        "time": 0.0
      },
      {
        "name": "injection_needextension",
        "time": 0.0
      },
      {
        "name": "injection_network_traffic",
        "time": 0.0
      },
      {
        "name": "injection_runpe",
        "time": 0.0
      },
      {
        "name": "section_mapping_injection",
        "time": 0.0
      },
      {
        "name": "injection_themeinitapihook",
        "time": 0.0
      },
      {
        "name": "apc_injection",
        "time": 0.0
      },
      {
        "name": "resumethread_remote_process",
        "time": 0.0
      },
      {
        "name": "injection_write_exe_process",
        "time": 0.0
      },
      {
        "name": "injection_write_process",
        "time": 0.0
      },
      {
        "name": "internet_dropper",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_mutex",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_named_pipe",
        "time": 0.0
      },
      {
        "name": "interprocess_comms_shared_memory",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_named_pipe",
        "time": 0.0
      },
      {
        "name": "ipc_namedpipe",
        "time": 0.0
      },
      {
        "name": "js_phish",
        "time": 0.0
      },
      {
        "name": "js_suspicious_redirect",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_internet_explorer_exporter",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_run_exe_helper_utility",
        "time": 0.0
      },
      {
        "name": "execute_ps_via_syncappvpublishingserver",
        "time": 0.0
      },
      {
        "name": "malicious_dynamic_function_loading",
        "time": 0.0
      },
      {
        "name": "reads_memory_remote_process",
        "time": 0.0
      },
      {
        "name": "unbacked_exception_filter",
        "time": 0.0
      },
      {
        "name": "unbacked_process_mitigation_alteration",
        "time": 0.0
      },
      {
        "name": "thread_unbacked_memory",
        "time": 0.0
      },
      {
        "name": "unbacked_api_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_dotnet_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_library_load",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_apc_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_protection_alteration",
        "time": 0.0
      },
      {
        "name": "unbacked_mutex_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_process_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_veh_registration",
        "time": 0.0
      },
      {
        "name": "unbacked_com_instantiation",
        "time": 0.0
      },
      {
        "name": "unbacked_crypto_operations",
        "time": 0.0
      },
      {
        "name": "unbacked_delay_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_file_dropping",
        "time": 0.0
      },
      {
        "name": "unbacked_process_enumeration",
        "time": 0.0
      },
      {
        "name": "unbacked_registry_modification",
        "time": 0.0
      },
      {
        "name": "unbacked_service_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_token_manipulation",
        "time": 0.0
      },
      {
        "name": "unbacked_wmi_execution",
        "time": 0.0
      },
      {
        "name": "unbacked_bind_shell",
        "time": 0.0
      },
      {
        "name": "unbacked_dns_resolution",
        "time": 0.0
      },
      {
        "name": "unbacked_memory_network_connection",
        "time": 0.0
      },
      {
        "name": "unbacked_named_pipe_creation",
        "time": 0.0
      },
      {
        "name": "unbacked_useragent_retrieval",
        "time": 0.0
      },
      {
        "name": "mimics_filetime",
        "time": 0.0
      },
      {
        "name": "amsi_bypass_via_com_registry",
        "time": 0.0
      },
      {
        "name": "access_auto_logons_via_registry",
        "time": 0.0
      },
      {
        "name": "access_boot_key_via_registry",
        "time": 0.0
      },
      {
        "name": "create_suspicious_lnk_files",
        "time": 0.0
      },
      {
        "name": "credential_access_via_windows_credential_history",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_microsoft_exchange",
        "time": 0.0
      },
      {
        "name": "dll_hijacking_via_waas_medic_svc_com_typelib",
        "time": 0.0
      },
      {
        "name": "execute_file_downloaded_via_openssh",
        "time": 0.0
      },
      {
        "name": "execute_safe_mode_from_suspicious_process",
        "time": 0.0
      },
      {
        "name": "execute_scripts_via_microsoft_management_console",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_processes_via_windows_mssql_service",
        "time": 0.0
      },
      {
        "name": "execution_from_self_extracting_archive",
        "time": 0.0
      },
      {
        "name": "ip_address_discovery_via_trusted_program",
        "time": 0.0
      },
      {
        "name": "load_dll_via_control_panel",
        "time": 0.0
      },
      {
        "name": "network_connection_via_suspicious_process",
        "time": 0.0
      },
      {
        "name": "potential_location_discovery_via_unusual_process",
        "time": 0.0
      },
      {
        "name": "store_executable_registry",
        "time": 0.0
      },
      {
        "name": "Suspicious_Execution_Via_MicrosoftExchangeTransportAgent",
        "time": 0.0
      },
      {
        "name": "suspicious_java_execution_via_win_scripts",
        "time": 0.0
      },
      {
        "name": "Suspicious_Scheduled_Task_Creation_Via_Masqueraded_XML_File",
        "time": 0.0
      },
      {
        "name": "uses_restart_manager_for_suspicious_activities",
        "time": 0.0
      },
      {
        "name": "modify_desktop_wallpaper",
        "time": 0.0
      },
      {
        "name": "modify_zoneid_ads",
        "time": 0.0
      },
      {
        "name": "move_file_on_reboot",
        "time": 0.0
      },
      {
        "name": "multiple_useragents",
        "time": 0.0
      },
      {
        "name": "network_anomaly",
        "time": 0.0
      },
      {
        "name": "network_bind",
        "time": 0.0
      },
      {
        "name": "etherhiding_smart_contract_call",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_archive",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_free_webhosting",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_generic",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_interactsh",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_opensource",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_pastesite",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_payload",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_serviceinterface",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_socialmedia",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_telegram",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_tempstorage",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_urlshortener",
        "time": 0.0
      },
      {
        "name": "network_cnc_https_useragent",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_exfil",
        "time": 0.0
      },
      {
        "name": "network_cnc_smtps_generic",
        "time": 0.0
      },
      {
        "name": "network_dns_idn",
        "time": 0.0
      },
      {
        "name": "network_dns_suspicious_querytype",
        "time": 0.0
      },
      {
        "name": "network_dns_tunneling_request",
        "time": 0.0
      },
      {
        "name": "explorer_http",
        "time": 0.0
      },
      {
        "name": "network_fake_useragent",
        "time": 0.0
      },
      {
        "name": "legitimate_domain_abuse",
        "time": 0.0
      },
      {
        "name": "suspicious_communication_trusted_site",
        "time": 0.0
      },
      {
        "name": "network_tor",
        "time": 0.0
      },
      {
        "name": "office_com_load",
        "time": 0.0
      },
      {
        "name": "office_dotnet_load",
        "time": 0.0
      },
      {
        "name": "office_mshtml_load",
        "time": 0.0
      },
      {
        "name": "office_vb_load",
        "time": 0.0
      },
      {
        "name": "office_wmi_load",
        "time": 0.0
      },
      {
        "name": "office_cve2017_11882_network",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444",
        "time": 0.0
      },
      {
        "name": "office_cve_2021_40444_m2",
        "time": 0.0
      },
      {
        "name": "office_flash_load",
        "time": 0.0
      },
      {
        "name": "office_postscript",
        "time": 0.0
      },
      {
        "name": "office_suspicious_processes",
        "time": 0.0
      },
      {
        "name": "decompress_exe",
        "time": 0.0
      },
      {
        "name": "persistence_via_autodial_dll_registry",
        "time": 0.0
      },
      {
        "name": "persistence_autorun",
        "time": 0.0
      },
      {
        "name": "persistence_autorun_tasks",
        "time": 0.0
      },
      {
        "name": "persistence_bootexecute",
        "time": 0.0
      },
      {
        "name": "persistence_registry_script",
        "time": 0.0
      },
      {
        "name": "powershell_download",
        "time": 0.0
      },
      {
        "name": "powershell_request",
        "time": 0.0
      },
      {
        "name": "createtoolhelp32snapshot_module_enumeration",
        "time": 0.0
      },
      {
        "name": "enumerates_running_processes",
        "time": 0.0
      },
      {
        "name": "process_interest",
        "time": 0.0
      },
      {
        "name": "process_needed",
        "time": 0.0
      },
      {
        "name": "ransomware_iocp_asynchronous_encryption",
        "time": 0.0
      },
      {
        "name": "kernel_crypto_driver_abuse",
        "time": 0.0
      },
      {
        "name": "mass_data_encryption",
        "time": 0.0
      },
      {
        "name": "ransomware_extension_hijack",
        "time": 0.0
      },
      {
        "name": "mass_file_modification_access",
        "time": 0.0
      },
      {
        "name": "ransomware_attribute_stripping",
        "time": 0.0
      },
      {
        "name": "ransomware_file_modifications",
        "time": 0.0
      },
      {
        "name": "mass_ransom_note_drop",
        "time": 0.0
      },
      {
        "name": "ransomware_message",
        "time": 0.0
      },
      {
        "name": "recon_beacon",
        "time": 0.0
      },
      {
        "name": "recon_programs",
        "time": 0.0
      },
      {
        "name": "recon_systeminfo",
        "time": 0.0
      },
      {
        "name": "accesses_recyclebin",
        "time": 0.0
      },
      {
        "name": "removes_zoneid_ads",
        "time": 0.0
      },
      {
        "name": "script_created_process",
        "time": 0.0
      },
      {
        "name": "script_network_activity",
        "time": 0.0
      },
      {
        "name": "suspicious_js_script",
        "time": 0.0
      },
      {
        "name": "javascript_timer",
        "time": 0.0
      },
      {
        "name": "secure_login_phishing",
        "time": 0.0
      },
      {
        "name": "securityxploded_modules",
        "time": 0.0
      },
      {
        "name": "get_clipboard_data",
        "time": 0.0
      },
      {
        "name": "sets_autoconfig_url",
        "time": 0.0
      },
      {
        "name": "spoofs_procname",
        "time": 0.0
      },
      {
        "name": "stack_pivot",
        "time": 0.0
      },
      {
        "name": "stack_pivot_file_created",
        "time": 0.0
      },
      {
        "name": "stack_pivot_process_create",
        "time": 0.0
      },
      {
        "name": "set_clipboard_data",
        "time": 0.0
      },
      {
        "name": "stealth_childproc",
        "time": 0.0
      },
      {
        "name": "stealth_system_procname",
        "time": 0.0
      },
      {
        "name": "stealth_timeout",
        "time": 0.0
      },
      {
        "name": "stealth_window",
        "time": 0.0
      },
      {
        "name": "queries_keyboard_layout",
        "time": 0.0
      },
      {
        "name": "queries_locale_api",
        "time": 0.0
      },
      {
        "name": "terminates_remote_process",
        "time": 0.0
      },
      {
        "name": "uiautomationcore_load",
        "time": 0.0
      },
      {
        "name": "user_enum",
        "time": 0.0
      },
      {
        "name": "mmc_dll_script_load",
        "time": 0.0
      },
      {
        "name": "mmc_dotnet_load",
        "time": 0.0
      },
      {
        "name": "virus",
        "time": 0.0
      },
      {
        "name": "webmail_phish",
        "time": 0.0
      },
      {
        "name": "persists_dev_util",
        "time": 0.0
      },
      {
        "name": "spawns_dev_util",
        "time": 0.0
      },
      {
        "name": "alters_windows_utility",
        "time": 0.0
      },
      {
        "name": "overwrites_accessibility_utility",
        "time": 0.0
      },
      {
        "name": "Potential_Lateral_Movement_Via_SMBEXEC",
        "time": 0.0
      },
      {
        "name": "potential_WebShell_Via_ScreenConnectServer",
        "time": 0.0
      },
      {
        "name": "uses_Microsoft_HTML_Help_Executable",
        "time": 0.0
      },
      {
        "name": "wiper_zeroedbytes",
        "time": 0.0
      },
      {
        "name": "wmi_create_process",
        "time": 0.0
      },
      {
        "name": "wmi_script_process",
        "time": 0.0
      },
      {
        "name": "deletes_files",
        "time": 0.0
      },
      {
        "name": "drops_files",
        "time": 0.0
      },
      {
        "name": "reads_files",
        "time": 0.0
      },
      {
        "name": "writes_files",
        "time": 0.0
      },
      {
        "name": "antianalysis_tls_section",
        "time": 0.0
      },
      {
        "name": "antivirus_clamav",
        "time": 0.0
      },
      {
        "name": "antivirus_virustotal",
        "time": 0.0
      },
      {
        "name": "bad_certs",
        "time": 0.0
      },
      {
        "name": "bad_ssl_certs",
        "time": 0.0
      },
      {
        "name": "banker_zeus_p2p",
        "time": 0.0
      },
      {
        "name": "banker_zeus_url",
        "time": 0.0
      },
      {
        "name": "bot_athenahttp",
        "time": 0.0
      },
      {
        "name": "bot_dirtjumper",
        "time": 0.0
      },
      {
        "name": "bot_drive",
        "time": 0.0
      },
      {
        "name": "bot_drive2",
        "time": 0.0
      },
      {
        "name": "bot_madness",
        "time": 0.0
      },
      {
        "name": "byod_loldrivers_match",
        "time": 0.0
      },
      {
        "name": "byod_novel_driver",
        "time": 0.0
      },
      {
        "name": "byod_post_load_exploitation",
        "time": 0.0
      },
      {
        "name": "byod_driver_service_install",
        "time": 0.0
      },
      {
        "name": "com_spawned_process",
        "time": 0.0
      },
      {
        "name": "family_proxyback",
        "time": 0.0
      },
      {
        "name": "flare_capa_antianalysis",
        "time": 0.0
      },
      {
        "name": "flare_capa_collection",
        "time": 0.0
      },
      {
        "name": "flare_capa_communication",
        "time": 0.0
      },
      {
        "name": "flare_capa_compiler",
        "time": 0.0
      },
      {
        "name": "flare_capa_datamanipulation",
        "time": 0.0
      },
      {
        "name": "flare_capa_executable",
        "time": 0.0
      },
      {
        "name": "flare_capa_hostinteraction",
        "time": 0.0
      },
      {
        "name": "flare_capa_impact",
        "time": 0.0
      },
      {
        "name": "flare_capa_lib",
        "time": 0.0
      },
      {
        "name": "flare_capa_linking",
        "time": 0.0
      },
      {
        "name": "flare_capa_loadcode",
        "time": 0.0
      },
      {
        "name": "flare_capa_malwarefamily",
        "time": 0.0
      },
      {
        "name": "flare_capa_nursery",
        "time": 0.0
      },
      {
        "name": "flare_capa_persistence",
        "time": 0.0
      },
      {
        "name": "flare_capa_runtime",
        "time": 0.0
      },
      {
        "name": "flare_capa_targeting",
        "time": 0.0
      },
      {
        "name": "threatfox",
        "time": 0.0
      },
      {
        "name": "log4shell",
        "time": 0.0
      },
      {
        "name": "mimics_extension",
        "time": 0.0
      },
      {
        "name": "network_ip_exe",
        "time": 0.0
      },
      {
        "name": "network_dga",
        "time": 0.0
      },
      {
        "name": "network_dga_fraunhofer",
        "time": 0.0
      },
      {
        "name": "network_dyndns",
        "time": 0.0
      },
      {
        "name": "network_icmp",
        "time": 0.0
      },
      {
        "name": "network_irc",
        "time": 0.0
      },
      {
        "name": "network_open_proxy",
        "time": 0.0
      },
      {
        "name": "network_smtp",
        "time": 0.0
      },
      {
        "name": "network_torgateway",
        "time": 0.0
      },
      {
        "name": "origin_langid",
        "time": 0.0
      },
      {
        "name": "origin_resource_langid",
        "time": 0.0
      },
      {
        "name": "overlay",
        "time": 0.0
      },
      {
        "name": "pe_deep_entrypoint",
        "time": 0.0
      },
      {
        "name": "packer_unknown_pe_section_name",
        "time": 0.0
      },
      {
        "name": "packer_aspack",
        "time": 0.0
      },
      {
        "name": "packer_aspirecrypt",
        "time": 0.0
      },
      {
        "name": "packer_bedsprotector",
        "time": 0.0
      },
      {
        "name": "packer_confuser",
        "time": 0.0
      },
      {
        "name": "packer_enigma",
        "time": 0.0
      },
      {
        "name": "packer_entropy",
        "time": 0.0
      },
      {
        "name": "packer_mpress",
        "time": 0.0
      },
      {
        "name": "packer_nate",
        "time": 0.0
      },
      {
        "name": "packer_nspack",
        "time": 0.0
      },
      {
        "name": "packer_smartassembly",
        "time": 0.0
      },
      {
        "name": "packer_spices",
        "time": 0.0
      },
      {
        "name": "packer_themida",
        "time": 0.0
      },
      {
        "name": "packer_titan",
        "time": 0.0
      },
      {
        "name": "packer_upx",
        "time": 0.0
      },
      {
        "name": "packer_vmprotect",
        "time": 0.0
      },
      {
        "name": "packer_yoda",
        "time": 0.0
      },
      {
        "name": "pe_cert_invalid_signature",
        "time": 0.0
      },
      {
        "name": "pe_cert_self_signed",
        "time": 0.0
      },
      {
        "name": "pe_cert_suspicious_issuer",
        "time": 0.0
      },
      {
        "name": "punch_plus_plus_pcres",
        "time": 0.0
      },
      {
        "name": "procmem_yara",
        "time": 0.0
      },
      {
        "name": "recon_checkip",
        "time": 0.0
      },
      {
        "name": "sigma_events",
        "time": 0.0
      },
      {
        "name": "static_authenticode",
        "time": 0.0
      },
      {
        "name": "invalid_authenticode_signature",
        "time": 0.0
      },
      {
        "name": "static_dotnet_anomaly",
        "time": 0.0
      },
      {
        "name": "static_java",
        "time": 0.0
      },
      {
        "name": "static_pdf",
        "time": 0.0
      },
      {
        "name": "contains_pe_overlay",
        "time": 0.0
      },
      {
        "name": "static_pe_anomaly",
        "time": 0.0
      },
      {
        "name": "pe_compile_timestomping",
        "time": 0.0
      },
      {
        "name": "static_pe_pdbpath",
        "time": 0.0
      },
      {
        "name": "static_rat_config",
        "time": 0.0
      },
      {
        "name": "static_versioninfo_anomaly",
        "time": 0.0
      },
      {
        "name": "browser_credential_theft_headless",
        "time": 0.0
      },
      {
        "name": "suricata_alert",
        "time": 0.0
      },
      {
        "name": "volatility_devicetree_1",
        "time": 0.0
      },
      {
        "name": "volatility_handles_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_1",
        "time": 0.0
      },
      {
        "name": "volatility_ldrmodules_2",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_1",
        "time": 0.0
      },
      {
        "name": "volatility_malfind_2",
        "time": 0.0
      },
      {
        "name": "volatility_modscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_1",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_2",
        "time": 0.0
      },
      {
        "name": "volatility_svcscan_3",
        "time": 0.0
      },
      {
        "name": "whois_create",
        "time": 0.0
      },
      {
        "name": "accesses_mailslot",
        "time": 0.0
      },
      {
        "name": "accesses_netlogon_regkey",
        "time": 0.0
      },
      {
        "name": "accesses_public_folder",
        "time": 0.0
      },
      {
        "name": "accesses_sysvol",
        "time": 0.0
      },
      {
        "name": "writes_sysvol",
        "time": 0.0
      },
      {
        "name": "adds_admin_user",
        "time": 0.0
      },
      {
        "name": "adds_user",
        "time": 0.0
      },
      {
        "name": "overwrites_admin_password",
        "time": 0.0
      },
      {
        "name": "antianalysis_detectfile",
        "time": 0.003
      },
      {
        "name": "antianalysis_detectreg",
        "time": 0.05
      },
      {
        "name": "modify_attachment_manager",
        "time": 0.0
      },
      {
        "name": "antiav_detectfile",
        "time": 0.006
      },
      {
        "name": "antiav_detectreg",
        "time": 0.239
      },
      {
        "name": "antiav_srp",
        "time": 0.0
      },
      {
        "name": "antiav_whitespace",
        "time": 0.0
      },
      {
        "name": "antidebug_devices",
        "time": 0.001
      },
      {
        "name": "antiemu_windefend",
        "time": 0.0
      },
      {
        "name": "antiemu_wine_reg",
        "time": 0.0
      },
      {
        "name": "antisandbox_cuckoo_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_fortinet_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_joe_anubis_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_sboxie_mutex",
        "time": 0.0
      },
      {
        "name": "antisandbox_sunbelt_files",
        "time": 0.0
      },
      {
        "name": "antisandbox_threattrack_files",
        "time": 0.0
      },
      {
        "name": "antivm_bochs_keys",
        "time": 0.004
      },
      {
        "name": "antivm_generic_bios",
        "time": 0.003
      },
      {
        "name": "antivm_generic_diskreg",
        "time": 0.009
      },
      {
        "name": "antivm_hyperv_keys",
        "time": 0.004
      },
      {
        "name": "antivm_parallels_keys",
        "time": 0.013
      },
      {
        "name": "antivm_recentdocs",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vbox_files",
        "time": 0.002
      },
      {
        "name": "antivm_vbox_keys",
        "time": 0.025
      },
      {
        "name": "antivm_vmware_devices",
        "time": 0.0
      },
      {
        "name": "antivm_vmware_files",
        "time": 0.001
      },
      {
        "name": "antivm_vmware_keys",
        "time": 0.017
      },
      {
        "name": "antivm_vmware_mutexes",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_files",
        "time": 0.0
      },
      {
        "name": "antivm_vpc_keys",
        "time": 0.008
      },
      {
        "name": "antivm_vpc_mutex",
        "time": 0.0
      },
      {
        "name": "antivm_xen_keys",
        "time": 0.013
      },
      {
        "name": "ketrican_regkeys",
        "time": 0.002
      },
      {
        "name": "bitcoin_opencl",
        "time": 0.0
      },
      {
        "name": "enumerates_physical_drives",
        "time": 0.0
      },
      {
        "name": "bot_russkill",
        "time": 0.0
      },
      {
        "name": "browser_addon",
        "time": 0.0
      },
      {
        "name": "chromium_browser_extension_directory",
        "time": 0.0
      },
      {
        "name": "browser_helper_object",
        "time": 0.0
      },
      {
        "name": "browser_security",
        "time": 0.0
      },
      {
        "name": "browser_startpage",
        "time": 0.0
      },
      {
        "name": "executes_headless_browser",
        "time": 0.0
      },
      {
        "name": "suspicious_browser_arguments",
        "time": 0.001
      },
      {
        "name": "ie_disables_process_tab",
        "time": 0.0
      },
      {
        "name": "odbcconf_bypass",
        "time": 0.003
      },
      {
        "name": "squiblydoo_bypass",
        "time": 0.0
      },
      {
        "name": "squiblytwo_bypass",
        "time": 0.0
      },
      {
        "name": "bypass_chromium_protection",
        "time": 0.0
      },
      {
        "name": "bypass_firewall",
        "time": 0.004
      },
      {
        "name": "checks_uac_status",
        "time": 0.001
      },
      {
        "name": "uac_bypass_cmstpcom",
        "time": 0.001
      },
      {
        "name": "uac_bypass_delegateexecute_sdclt",
        "time": 0.0
      },
      {
        "name": "uac_bypass_fodhelper",
        "time": 0.0
      },
      {
        "name": "cape_extracted_content",
        "time": 0.0
      },
      {
        "name": "clears_logs",
        "time": 0.0
      },
      {
        "name": "cmdline_obfuscation",
        "time": 0.0
      },
      {
        "name": "cmdline_switches",
        "time": 0.0
      },
      {
        "name": "cmdline_terminate",
        "time": 0.0
      },
      {
        "name": "cmdline_forfiles_wildcard",
        "time": 0.0
      },
      {
        "name": "cmdline_http_link",
        "time": 0.0
      },
      {
        "name": "cmdline_long_string",
        "time": 0.0
      },
      {
        "name": "cmdline_reversed_http_link",
        "time": 0.0
      },
      {
        "name": "long_commandline",
        "time": 0.0
      },
      {
        "name": "powershell_renamed_commandline",
        "time": 0.0
      },
      {
        "name": "copies_self",
        "time": 0.0
      },
      {
        "name": "credwiz_credentialaccess",
        "time": 0.0
      },
      {
        "name": "enables_wdigest",
        "time": 0.0
      },
      {
        "name": "vaultcmd_credentialaccess",
        "time": 0.0
      },
      {
        "name": "file_credential_store_access",
        "time": 0.0
      },
      {
        "name": "file_credential_store_write",
        "time": 0.0
      },
      {
        "name": "kerberos_credential_access_via_rubeus",
        "time": 0.0
      },
      {
        "name": "registry_credential_dumping",
        "time": 0.0
      },
      {
        "name": "registry_lsa_secrets_access",
        "time": 0.0
      },
      {
        "name": "comsvcs_credentialdump",
        "time": 0.0
      },
      {
        "name": "cryptomining_stratum_command",
        "time": 0.0
      },
      {
        "name": "deepfreeze_mutex",
        "time": 0.0
      },
      {
        "name": "deletes_executed_files",
        "time": 0.0
      },
      {
        "name": "disables_app_launch",
        "time": 0.0
      },
      {
        "name": "disables_auto_app_termination",
        "time": 0.0
      },
      {
        "name": "disables_appv_virtualization",
        "time": 0.0
      },
      {
        "name": "disables_backups",
        "time": 0.0
      },
      {
        "name": "disables_browser_warn",
        "time": 0.0
      },
      {
        "name": "disables_context_menus",
        "time": 0.0
      },
      {
        "name": "disables_cpl_disable",
        "time": 0.0
      },
      {
        "name": "disables_crashdumps",
        "time": 0.0
      },
      {
        "name": "disables_event_logging",
        "time": 0.0
      },
      {
        "name": "disables_folder_options",
        "time": 0.0
      },
      {
        "name": "disables_notificationcenter",
        "time": 0.0
      },
      {
        "name": "disables_power_options",
        "time": 0.0
      },
      {
        "name": "disables_restore_default_state",
        "time": 0.0
      },
      {
        "name": "disables_run_command",
        "time": 0.0
      },
      {
        "name": "disables_smartscreen",
        "time": 0.0
      },
      {
        "name": "disables_startmenu_search",
        "time": 0.0
      },
      {
        "name": "disables_system_restore",
        "time": 0.0
      },
      {
        "name": "disables_uac",
        "time": 0.0
      },
      {
        "name": "disables_wer",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender",
        "time": 0.0
      },
      {
        "name": "disables_windows_defender_logging",
        "time": 0.001
      },
      {
        "name": "removes_windows_defender_contextmenu",
        "time": 0.001
      },
      {
        "name": "removes_windows_defender_updates",
        "time": 0.0
      },
      {
        "name": "windows_defender_powershell",
        "time": 0.0
      },
      {
        "name": "disables_windows_file_protection",
        "time": 0.0
      },
      {
        "name": "disables_windowsupdate",
        "time": 0.0
      },
      {
        "name": "disables_winfirewall",
        "time": 0.0
      },
      {
        "name": "folder_enumeration",
        "time": 0.001
      },
      {
        "name": "discover_registry_mount_points",
        "time": 0.001
      },
      {
        "name": "adfind_domain_enumeration",
        "time": 0.0
      },
      {
        "name": "domain_enumeration_commands",
        "time": 0.0
      },
      {
        "name": "driver_filtermanager",
        "time": 0.0
      },
      {
        "name": "dropper",
        "time": 0.0
      },
      {
        "name": "dll_archive_execution",
        "time": 0.0
      },
      {
        "name": "lnk_archive_execution",
        "time": 0.0
      },
      {
        "name": "script_archive_execution",
        "time": 0.0
      },
      {
        "name": "excel4_macro_urls",
        "time": 0.0
      },
      {
        "name": "escalate_privilege_via_ntlm_relay",
        "time": 0.0
      },
      {
        "name": "spooler_access",
        "time": 0.0
      },
      {
        "name": "spooler_svc_start",
        "time": 0.0
      },
      {
        "name": "mapped_drives_uac",
        "time": 0.0
      },
      {
        "name": "hides_recycle_bin_icon",
        "time": 0.0
      },
      {
        "name": "infostealer_bitcoin",
        "time": 0.003
      },
      {
        "name": "infostealer_ftp",
        "time": 0.08
      },
      {
        "name": "infostealer_im",
        "time": 0.044
      },
      {
        "name": "infostealer_mail",
        "time": 0.009
      },
      {
        "name": "Evade_Execution_Via_ASPNet_Compiler",
        "time": 0.0
      },
      {
        "name": "Evade_Execute_Via_DeviceCredentialDeployment",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Filter_Manager_Control",
        "time": 0.0
      },
      {
        "name": "Evade_Execution_Via_Intel_GFXDownloadWrapper",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_appvlp",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_OpenSSH",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_pcalua",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_PesterPSModule",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_ScriptRunner",
        "time": 0.0
      },
      {
        "name": "execute_binary_via_ttdinject",
        "time": 0.0
      },
      {
        "name": "Execute_Binary_Via_VisualStudioLiveShare",
        "time": 0.0
      },
      {
        "name": "Execute_Msiexec_Via_Explorer",
        "time": 0.0
      },
      {
        "name": "execute_remote_msi",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_runscripthelper",
        "time": 0.0
      },
      {
        "name": "execute_suspicious_powershell_via_sqlps",
        "time": 0.0
      },
      {
        "name": "Indirect_Command_Execution_Via_ConsoleWindowHost",
        "time": 0.0
      },
      {
        "name": "Perform_Malicious_Activities_Via_Headless_Browser",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_CertOC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_MSIEXEC",
        "time": 0.0
      },
      {
        "name": "Register_DLL_Via_Odbcconf",
        "time": 0.0
      },
      {
        "name": "Scriptlet_Proxy_Execution_Via_Pubprn",
        "time": 0.0
      },
      {
        "name": "ie_martian_children",
        "time": 0.0
      },
      {
        "name": "office_martian_children",
        "time": 0.0
      },
      {
        "name": "mimics_icon",
        "time": 0.0
      },
      {
        "name": "masquerade_process_name",
        "time": 0.008
      },
      {
        "name": "mimikatz_modules",
        "time": 0.0
      },
      {
        "name": "ms_office_cmd_rce",
        "time": 0.0
      },
      {
        "name": "mount_copy_to_webdav_share",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_legit_utilities",
        "time": 0.0
      },
      {
        "name": "potential_protocol_tunneling_via_qemu",
        "time": 0.0
      },
      {
        "name": "suspicious_execution_via_dotnet_remoting",
        "time": 0.0
      },
      {
        "name": "dotnet_clr_usagelog_regkeys",
        "time": 0.0
      },
      {
        "name": "modify_hostfile",
        "time": 0.0
      },
      {
        "name": "modify_oem_information",
        "time": 0.0
      },
      {
        "name": "modify_security_center_warnings",
        "time": 0.0
      },
      {
        "name": "modify_uac_prompt",
        "time": 0.0
      },
      {
        "name": "network_dns_blockchain",
        "time": 0.0
      },
      {
        "name": "network_dns_opennic",
        "time": 0.0
      },
      {
        "name": "network_dns_paste_site",
        "time": 0.0
      },
      {
        "name": "network_dns_reverse_proxy",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_file_storage",
        "time": 0.0
      },
      {
        "name": "network_dns_temp_urldns",
        "time": 0.0
      },
      {
        "name": "network_dns_url_shortener",
        "time": 0.0
      },
      {
        "name": "network_dns_doh_tls",
        "time": 0.0
      },
      {
        "name": "suspicious_tld",
        "time": 0.0
      },
      {
        "name": "network_tor_service",
        "time": 0.0
      },
      {
        "name": "office_code_page",
        "time": 0.0
      },
      {
        "name": "office_addinloading",
        "time": 0.0
      },
      {
        "name": "office_perfkey",
        "time": 0.0
      },
      {
        "name": "office_macro",
        "time": 0.0
      },
      {
        "name": "changes_trust_center_settings",
        "time": 0.0
      },
      {
        "name": "disables_vba_trust_access",
        "time": 0.0
      },
      {
        "name": "office_macro_autoexecution",
        "time": 0.0
      },
      {
        "name": "office_macro_ioc",
        "time": 0.0
      },
      {
        "name": "office_macro_malicious_prediction",
        "time": 0.0
      },
      {
        "name": "office_macro_suspicious",
        "time": 0.0
      },
      {
        "name": "rtf_aslr_bypass",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_characterset",
        "time": 0.0
      },
      {
        "name": "rtf_anomaly_version",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_content",
        "time": 0.0
      },
      {
        "name": "rtf_embedded_office_file",
        "time": 0.0
      },
      {
        "name": "rtf_exploit_static",
        "time": 0.0
      },
      {
        "name": "office_security",
        "time": 0.0
      },
      {
        "name": "accesses_office_username",
        "time": 0.0
      },
      {
        "name": "office_anomalous_feature",
        "time": 0.0
      },
      {
        "name": "office_dde_command",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_mutex",
        "time": 0.0
      },
      {
        "name": "packer_armadillo_regkey",
        "time": 0.001
      },
      {
        "name": "persistence_ads",
        "time": 0.0
      },
      {
        "name": "persistence_safeboot",
        "time": 0.0
      },
      {
        "name": "persistence_ifeo",
        "time": 0.0
      },
      {
        "name": "persistence_silent_process_exit",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_registry",
        "time": 0.0
      },
      {
        "name": "persistence_rdp_shadowing",
        "time": 0.0
      },
      {
        "name": "persistence_service",
        "time": 0.0
      },
      {
        "name": "persistence_shim_database",
        "time": 0.0
      },
      {
        "name": "powershell_scriptblock_logging",
        "time": 0.0
      },
      {
        "name": "powershell_command_suspicious",
        "time": 0.0
      },
      {
        "name": "powershell_history_save_mod",
        "time": 0.0
      },
      {
        "name": "powershell_renamed",
        "time": 0.0
      },
      {
        "name": "powershell_reversed",
        "time": 0.0
      },
      {
        "name": "powershell_variable_obfuscation",
        "time": 0.0
      },
      {
        "name": "prevents_safeboot",
        "time": 0.0
      },
      {
        "name": "cmdline_process_discovery",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_generic",
        "time": 0.0
      },
      {
        "name": "ransomware_extensions_known",
        "time": 0.002
      },
      {
        "name": "ransomware_files",
        "time": 0.004
      },
      {
        "name": "ransomware_recyclebin",
        "time": 0.0
      },
      {
        "name": "ransomware_revil_regkey",
        "time": 0.0
      },
      {
        "name": "reads_password_database",
        "time": 0.0
      },
      {
        "name": "recon_fingerprint",
        "time": 0.002
      },
      {
        "name": "rdptcp_key",
        "time": 0.0
      },
      {
        "name": "uses_rdp_clip",
        "time": 0.0
      },
      {
        "name": "uses_remote_desktop_session",
        "time": 0.0
      },
      {
        "name": "removes_networking_icon",
        "time": 0.0
      },
      {
        "name": "removes_pinned_programs",
        "time": 0.0
      },
      {
        "name": "removes_security_maintenance_icon",
        "time": 0.0
      },
      {
        "name": "removes_startmenu_defaults",
        "time": 0.0
      },
      {
        "name": "removes_username_startmenu",
        "time": 0.0
      },
      {
        "name": "sniffer_winpcap",
        "time": 0.0
      },
      {
        "name": "spreading_autoruninf",
        "time": 0.0
      },
      {
        "name": "stealth_hidden_extension",
        "time": 0.0
      },
      {
        "name": "stealth_hiddenreg",
        "time": 0.0
      },
      {
        "name": "stealth_hide_notifications",
        "time": 0.0
      },
      {
        "name": "stealth_webhistory",
        "time": 0.0
      },
      {
        "name": "sysinternals_psexec",
        "time": 0.0
      },
      {
        "name": "sysinternals_tools",
        "time": 0.0
      },
      {
        "name": "language_check_registry",
        "time": 0.0
      },
      {
        "name": "tampers_etw",
        "time": 0.0
      },
      {
        "name": "lsa_tampering",
        "time": 0.0
      },
      {
        "name": "tampers_powershell_logging",
        "time": 0.0
      },
      {
        "name": "territorial_disputes_sigs",
        "time": 0.074
      },
      {
        "name": "uses_adfind",
        "time": 0.0
      },
      {
        "name": "uses_ms_protocol",
        "time": 0.0
      },
      {
        "name": "owa_web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_files",
        "time": 0.0
      },
      {
        "name": "web_shell_processes",
        "time": 0.0
      },
      {
        "name": "dotnet_csc_build",
        "time": 0.0
      },
      {
        "name": "mavinject_lolbin",
        "time": 0.0
      },
      {
        "name": "multiple_explorer_instances",
        "time": 0.0
      },
      {
        "name": "script_tool_executed",
        "time": 0.0
      },
      {
        "name": "suspicious_certutil_use",
        "time": 0.0
      },
      {
        "name": "suspicious_command_tools",
        "time": 0.007
      },
      {
        "name": "suspicious_mpcmdrun_use",
        "time": 0.0
      },
      {
        "name": "suspicious_ping_use",
        "time": 0.0
      },
      {
        "name": "uses_powershell_copyitem",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities",
        "time": 0.007
      },
      {
        "name": "uses_windows_utilities_appcmd",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_csvde_ldifde",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_cipher",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_clickonce",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_curl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_dsquery",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_esentutl",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_finger",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_mode",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_ntdsutil",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_nltest",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_setx",
        "time": 0.0
      },
      {
        "name": "uses_windows_utilities_xcopy",
        "time": 0.0
      },
      {
        "name": "wmic_command_suspicious",
        "time": 0.0
      },
      {
        "name": "scrcons_wmi_script_consumer",
        "time": 0.0
      }
    ],
    "reporting": [
      {
        "name": "BinGraph",
        "time": 0.0
      }
    ]
  },
  "dropped": [
    {
      "name": [
        "store.db-journal"
      ],
      "path": "/opt/CAPEv2/storage/analyses/17/files/e910871b6e02883f21522e53168ffe0a267f7e309af573325892e5a1f1eed49d",
      "guest_paths": [
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "size": 12824,
      "crc32": "81ED1F51",
      "md5": "31f7dc66cef410e6265f1429fbcb9aac",
      "sha1": "0a93d85d568428558ca130fb592071d6c4dc2bca",
      "sha256": "e910871b6e02883f21522e53168ffe0a267f7e309af573325892e5a1f1eed49d",
      "sha512": "fb401cc57f662e51de2070f1ccf04534fc1f5b11e367c60cdb7461610ec8923ee9a7a19283ba578ae73df28b9e2ec045db3f427cf6f18af3d5ac502d13357aa4",
      "rh_hash": null,
      "ssdeep": "192:7pFdp0xCVYdCkydBLXzU89EJ6Co09dVNglN/KFFz16GH6Kr:7p9OCVOCP1zUKR0fvCN2FV6Kr",
      "type": "SQLite Rollback Journal",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1BA42B12869FD2225F1B3B8FDEFF4D446CA23B6615A37D90E105E430A0BA3E015D91B39",
      "sha3_384": "5742f0f210dc67ff9d93ec4d36c8a69e73f07eb7f8eb2d34f51378e973dd6b6db9b5fa298ca1ad1a399ed8342cd15433",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10",
      "data": null,
      "strings": [
        "tableUPDATESPROPUPDATESPROP",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0fbe0765-21b6-47e8-9792-47e39f5c05c6?P1=1779985037&P2=404&P3=2&P4=Ir4PUtx5cBZutLJU0g9tZVL4UFnVvaNSDgrjOYkp1vnafnftfXftk0yIXvJLl7OZuSgvieSemBytVaMQm8Qw5A%3d%3d",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/9c97cff4-6789-4a25-be47-d2cd882bf886?P1=1779995107&P2=404&P3=2&P4=KsIKmxZrexfl8Xcdnp%2fEPAvTqXynYLf7ZoOe7Sz6F4XG%2b%2b9b2qJ%2fmLCkJMRZaEqXko2b%2fLzKe03NJRMlDGj%2fzQ%3d%3d",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/37264eb1-ac70-466f-9383-031283641d02?P1=1779985037&P2=404&P3=2&P4=VMlcwMxQC1ONqmsg0v4yC5aAMIgyzqLHVLQNq7KlBntOSt%2f48%2bmASfDVeUugm7wDP4yeRRhXUONjPNZOeILrWA%3d%3d",
        "CREATE TABLE VARIABLES (            KEY        TEXT NOT NULL COLLATE NOCASE CHECK(KEY <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(KEY))",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/7ab18932-380d-4fc1-a70b-bef8f06ea93e?P1=1779985037&P2=404&P3=2&P4=RN5sXMplVNNic9amQIA9K64QyLSIJ%2fXIqtS6cnWgnvjVv4pKm3ssuRIswkgjOc2eKR%2f3mdFsOjb3G51B3aTDPA%3d%3d",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/b18ba127-bb7d-4e8c-92f7-a7355cb3cae7?P1=1779985037&P2=404&P3=2&P4=nDKY%2fyUPg9zkCbmyvWmp40T8Y7c4m%2fmLlHEhgtxeGvj229%2fb4pJ%2fSYEvpvNaofNyc0JDOtYP5g1avqstHwz23g%3d%3d",
        "9hjeCT4PU68IusV.1.1",
        "indexsqlite_autoindex_ACTIONRECORDS_1ACTIONRECORDS",
        "CREATE TABLE ACTIONRECORDS (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            TIME                  TEXT,            ACTION                TEXT,            ACTIONCLASS           TEXT,            RESULT                INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, TIME)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        ".dl.delivery.mp.microsoft.com/filestreamingservice/files/ceab12dc-32fa-4752-be92-259e4e99109e?P1=1779985037&P2=404&P3=2&P4=Oz9RSTtu1U6AB7v7OJZKTfoItGXLhKw5MTO9gnK%2bqPl3p4z09iApxrbLhBdTNA8PiUanFpKyvAY4wd8cU3JnHQ%3d%3d",
        "9cd910c4-6018-42ea-8916-06181f858ca4",
        "tableUPDATESUPDATES",
        "indexsqlite_autoindex_UPDATES_1UPDATES",
        "Z9hjeCT4PU68IusV.1.1",
        "indexsqlite_autoindex_PROVIDERSPROP_1PROVIDERSPROP",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/7a53c8b1-7eb7-4611-963c-d61fb8a5c854?P1=1779985037&P2=404&P3=2&P4=AJMd06gkIGTmB37V0B%2fRw37qgTPXes2R7sUXFbgTjuhk6PE6xgakdH6WXhWKLSkmY7OGR6i6f2huAYI76fl9yQ%3d%3d",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/738bfe02-63c9-4f89-b85b-853205d78960?P1=1779985037&P2=404&P3=2&P4=aVQu0%2bFoksVcOer1FgHQhV%2fl6E0fjSdxBaU5sefEN2h0gb88tV8dA8CX7cZDt6%2fD0OWFkYcjOLWbDbEA04QrSw%3d%3d",
        "tableACTIONRECORDSACTIONRECORDS",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d042f203-ede1-441f-b0dc-4c32e21b093c?P1=1779985037&P2=404&P3=2&P4=SiZ3cZYCjVrmRS6q2W50Y%2bqqCYAUxbpcPQwfb2lTqbubA%2f5u0LzTfOTvYtNUaSmnB0t2%2fpNVqrw1EuVTTXMdYA%3d%3d",
        "CREATE TABLE UPDATESPROP (            PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID   TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            VARIABLE   TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, VARIABLE)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/86d5253e-6389-4645-bab1-68a1d0a48625?P1=1779985037&P2=404&P3=2&P4=h8BGiChDcwZLU1K5ASJtd9PldcIrf%2bya2%2bx0CMeJyuD34pg99GUrtZhk6%2b1fh0rMwyqfRDzXCCOBRhAWR7hoRQ%3d%3d",
        "tableVARIABLESVARIABLES",
        "RS:31714",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/3a8f4a6b-f3db-4709-851a-8032e4522f66?P1=1779985037&P2=404&P3=2&P4=bapwOFrRAd1D4Fao6AHwcrfpftlu8mS3s0T%2ftWU4KapTYylGm3OStM5QFXoMZngNegz4HlkVy8L%2bJ7UhxkkVYw%3d%3d",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/54ed90e8-f53a-4c07-896f-2c40acc2fd03?P1=177998503",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4a5103e5-56a1-484d-b0fc-2835caa0db45?P1=1779985037&P2=404&P3=2&P4=AJ9ZgBg3wN8KdSRE2cO8jvNauzoYGdOx1U3dP5nSTNV2XW3rBwhhPhIXjnIPK9GU5d3x6HH0i1QZOcm0NEP%2fGA%3d%3d",
        "MoUpdateOrchestrator",
        "CREATE TABLE UPDATES (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            SERIALIZEDUPDATE      BLOB,            PRIMARY KEY(PROVIDERID, UPDATEID))",
        "Client.OS.RS2.amd64",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c6db46f1-0be2-40a5-b6a0-1c05fd56a4b8?P1=1779985037&P2=404&P3=2&P4=dU%2f4KKPAxjf1Rh17quhAfNrq51852hfigsNEsduBBtzhMKlLqGyKizBJP3eEU3FBfuTCsjkh%2faFYBVdcFITQSQ%3d%3d",
        " security bulletin as critical, important, moderate, or low.",
        "IsUpgradeRepair",
        "indexsqlite_autoindex_UPDATESPROP_1UPDATESPROP",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/74c6307b-4684-4548-9ea0-cd9f9b5e9129?P1=1779985037&P2=404&P3=2&P4=EJJsBd5gw6MnvvgqIzNJI5xXQ5%2bXLx38EcAHX5Q%2b1pyydK8QpLLg%2bdffkYzK9SDltQvDOvKJm9wZTcx6kWS0%2bw%3d%3d",
        "indexsqlite_autoindex_VARIABLES_1VARIABLES",
        "SQLite format 3",
        "-specific security-related vulnerability. Security vulnerabilities are rated based on their severity which is indicated in the Microsoft",
        "UpdateClassification",
        "{\"BuildFlightID\":\"RS:31714\", \"BuildFlightVersion\":\"10.0.19045.6456\"}"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": ""
    },
    {
      "name": [
        "store.db-journal"
      ],
      "path": "/opt/CAPEv2/storage/analyses/17/files/237c6c609dce209c2cbaaace9f781120c6935b987fc61fc6fc2ecc5ea9c4892b",
      "guest_paths": [
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "size": 8720,
      "crc32": "9A0797BC",
      "md5": "215b018d13b68d2e8086cfbcdca72b41",
      "sha1": "b9233adbd80da6fa7eb5f8481a0227f90bfd9d89",
      "sha256": "237c6c609dce209c2cbaaace9f781120c6935b987fc61fc6fc2ecc5ea9c4892b",
      "sha512": "4ed2d7486cca79cf322b35cfbd72d0d6b4786cff455ca7998097455171f9b68ec5f37a1028965c3069b64e3811eac50d1a044e8a1e41e734d7ee356773589862",
      "rh_hash": null,
      "ssdeep": "96:7WAvR0pKKZU5yfYat6CG9G5OGFGnGiesG9GURGzn7:7r0pKshYat6qK7",
      "type": "SQLite Rollback Journal",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1CC02312476EC2118E173B6F58FF8D945DB23FAA51A37C61F201D128B0B93E419E5173A",
      "sha3_384": "a319150d003e234d89df5a96e46d34cb8183a8349ad41ed2bf5c05d265d3a8f07465d0fddd37bbdb4d89296354989d85",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10",
      "data": null,
      "strings": [
        "tableUPDATESPROPUPDATESPROP",
        "Windows 8.1 and later drivers",
        "This new category will be used for all future pre-release feature update publishes to WSUS, primarily for SCCM consumption.",
        "CREATE TABLE VARIABLES (            KEY        TEXT NOT NULL COLLATE NOCASE CHECK(KEY <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(KEY))",
        "http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/Cbs",
        "e7441a84-4561-465f-9e0e-7fc16fa25ea7",
        "2d2a68ab-50ca-4d80-b96c-757bc32024c7",
        "CREATE TABLE ACTIONRECORDS (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            TIME                  TEXT,            ACTION                TEXT,            ACTIONCLASS           TEXT,            RESULT                INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, TIME)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "indexsqlite_autoindex_ACTIONRECORDS_1ACTIONRECORDS",
        "tableUPDATESUPDATES",
        "Windows Dictionary Updates for Simplified Chinese, Japanese Input Methods and English (US) Bing trendy words.",
        "indexsqlite_autoindex_UPDATES_1UPDATES",
        "Category for Windows Ultimate Extras",
        "indexsqlite_autoindex_PROVIDERSPROP_1PROVIDERSPROP",
        "50c04525-9b15-4f7c-bed4-87455bcd7ded",
        "Windows Media Dynamic Installer",
        "Windows Media Setup Updates",
        "e88a19fb-a847-4e3d-9ae2-13c2b84f58a6",
        "Windows Ultimate Extras",
        "6500af43-533e-41f8-8413-f70648777d13",
        "405706ed-f1d7-47ea-91e1-eb8860039715",
        "tableACTIONRECORDSACTIONRECORDS",
        "CREATE TABLE UPDATESPROP (            PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID   TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            VARIABLE   TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, VARIABLE)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "ca006cfb-49eb-439b-880a-1312e1fc9713",
        "Windows10.0-KB5011048-x64",
        "http://download.windowsupdate.com/c/msdownload/update/software/ftpk/2023/09/windows10.0-kb5011048-x64_8bac8a1de5a48c93c3fb1e55582ce2ea79848f00.cab",
        "tableVARIABLESVARIABLES",
        "72e7624a-5b00-45d2-b92f-e561c0a6a160",
        "Windows Dictionary Updates",
        "Windows Security service and user interface.",
        "065f7282-5b8a-4a50-82b2-26590630ca7f",
        "MoUpdateOrchestrator",
        "Windows Security platform",
        "CREATE TABLE UPDATES (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            SERIALIZEDUPDATE      BLOB,            PRIMARY KEY(PROVIDERID, UPDATEID))",
        "Windows 11",
        "IsUpgradeRepair",
        "Z9hjeCT4PU68IusV.3.1",
        "indexsqlite_autoindex_UPDATESPROP_1UPDATESPROP",
        "indexsqlite_autoindex_VARIABLES_1VARIABLES",
        "Windows Insider Pre-Release",
        "SQLite format 3",
        "Product",
        "9hjeCT4PU68IusV.3.1"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": ""
    },
    {
      "name": [
        "store.db-journal"
      ],
      "path": "/opt/CAPEv2/storage/analyses/17/files/866fe1662e0c3fac01b71d4b39b0f0bee2d7411e841de5b85c19741d1af11d90",
      "guest_paths": [
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "size": 8720,
      "crc32": "8BC0D70E",
      "md5": "e97d08f5a4e5cc058779b0ef280b6c00",
      "sha1": "680bacf2596b0f353970922e81a69f061e3b8805",
      "sha256": "866fe1662e0c3fac01b71d4b39b0f0bee2d7411e841de5b85c19741d1af11d90",
      "sha512": "9111b9a0c930ec1edba6ac9cdd453db2b187e5021ee46834238853dea889c3042b3bdce81fb23297b0239a00dfc2e3ed2761e8d8968aa73fac824efb8270afa3",
      "rh_hash": null,
      "ssdeep": "96:78AvR0pKKZbamhdGjp9gIr+G9G5OGFGnGiesG9GURGznx:7V0pKsNhdGjp9gIKKx",
      "type": "SQLite Rollback Journal",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T15C0243147AE82114E173B6FA8FF8C545CB27FDA51A37C61F215E028B0B93E019E51B3A",
      "sha3_384": "a96036a896579984910b53338990bd9735b1cb1d85155f2d384656d3b3e738208a3cadd9e339766706ea1e9add20d254",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10",
      "data": null,
      "strings": [
        "tableUPDATESPROPUPDATESPROP",
        "Windows 8.1 and later drivers",
        "This new category will be used for all future pre-release feature update publishes to WSUS, primarily for SCCM consumption.",
        "Windows10.0-KB5066135-x64-NDP48",
        "CREATE TABLE VARIABLES (            KEY        TEXT NOT NULL COLLATE NOCASE CHECK(KEY <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(KEY))",
        "http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/Cbs",
        "e7441a84-4561-465f-9e0e-7fc16fa25ea7",
        "7af003b1-af83-4b84-aaf9-4cd92829d2f5",
        "9hjeCT4PU68IusV.1.1",
        "2d2a68ab-50ca-4d80-b96c-757bc32024c7",
        "CREATE TABLE ACTIONRECORDS (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            TIME                  TEXT,            ACTION                TEXT,            ACTIONCLASS           TEXT,            RESULT                INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, TIME)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "indexsqlite_autoindex_ACTIONRECORDS_1ACTIONRECORDS",
        "tableUPDATESUPDATES",
        "Windows Dictionary Updates for Simplified Chinese, Japanese Input Methods and English (US) Bing trendy words.",
        "indexsqlite_autoindex_UPDATES_1UPDATES",
        "Z9hjeCT4PU68IusV.1.1",
        "d9d879de-9ad5-4846-83f7-5a29fa59b8b7",
        "Category for Windows Ultimate Extras",
        "indexsqlite_autoindex_PROVIDERSPROP_1PROVIDERSPROP",
        "50c04525-9b15-4f7c-bed4-87455bcd7ded",
        "Windows Media Dynamic Installer",
        "Windows Media Setup Updates",
        "e88a19fb-a847-4e3d-9ae2-13c2b84f58a6",
        "Windows Ultimate Extras",
        "405706ed-f1d7-47ea-91e1-eb8860039715",
        "tableACTIONRECORDSACTIONRECORDS",
        "CREATE TABLE UPDATESPROP (            PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID   TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            VARIABLE   TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, VARIABLE)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "ca006cfb-49eb-439b-880a-1312e1fc9713",
        "tableVARIABLESVARIABLES",
        "72e7624a-5b00-45d2-b92f-e561c0a6a160",
        "Windows Dictionary Updates",
        "Windows Security service and user interface.",
        "MoUpdateOrchestrator",
        "Windows Security platform",
        "CREATE TABLE UPDATES (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            SERIALIZEDUPDATE      BLOB,            PRIMARY KEY(PROVIDERID, UPDATEID))",
        "Windows 11",
        "IsUpgradeRepair",
        "indexsqlite_autoindex_UPDATESPROP_1UPDATESPROP",
        "indexsqlite_autoindex_VARIABLES_1VARIABLES",
        "http://download.windowsupdate.com/c/msdownload/update/software/secu/2025/09/windows10.0-kb5066135-x64-ndp48_cf6ef8abaf08a1d539382ea258a95f2fe6589880.cab",
        "Windows Insider Pre-Release",
        "SQLite format 3",
        "Product"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": ""
    },
    {
      "name": [
        "store.db-journal"
      ],
      "path": "/opt/CAPEv2/storage/analyses/17/files/80ef5df696bf1f3c09c36b276d4bc0a81d7a1e83e970c10d466fd42ce5f239e2",
      "guest_paths": [
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "size": 8720,
      "crc32": "C27E255A",
      "md5": "db673bb9ef5b83cfa52ed697499da24e",
      "sha1": "237553dd60bd2f160d5383b8a691d186bb6a16aa",
      "sha256": "80ef5df696bf1f3c09c36b276d4bc0a81d7a1e83e970c10d466fd42ce5f239e2",
      "sha512": "35e8cfc7e9d7f1c908e87ac96d47cbe7551e74f8dda9cc70082a62531c73ef7881c4cbc66c7ed32cfec3f2773bd0731d9f2bff1abcf41698e84238db2e9e8e19",
      "rh_hash": null,
      "ssdeep": "96:7xhAvR0pKKZZ4MDZVD+nKG9G5OGFGnGiesG9GURGznv:7xa0pKsLDZVD+niKv",
      "type": "SQLite Rollback Journal",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1F102202476E86114E173B6F98FF8D545CB27FEA91A37D61F201D024B0B93E00AE5173A",
      "sha3_384": "d560b0a36ddc6a595b18d27b77e83191fbefe607d955bfc3c284880ec0e09294e5ca0f235c935f0a3996204ac543ee2b",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10",
      "data": null,
      "strings": [
        "tableUPDATESPROPUPDATESPROP",
        "Windows 8.1 and later drivers",
        "http://download.windowsupdate.com/d/msdownload/update/software/updt/2024/05/windows10.0-kb5001716-x64_a2bb12707df4d0d7ecfc8693d3ce965aa0ff2c9d.cab",
        "This new category will be used for all future pre-release feature update publishes to WSUS, primarily for SCCM consumption.",
        "CREATE TABLE VARIABLES (            KEY        TEXT NOT NULL COLLATE NOCASE CHECK(KEY <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(KEY))",
        "e7441a84-4561-465f-9e0e-7fc16fa25ea7",
        "9hjeCT4PU68IusV.1.1",
        "2d2a68ab-50ca-4d80-b96c-757bc32024c7",
        "CREATE TABLE ACTIONRECORDS (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            TIME                  TEXT,            ACTION                TEXT,            ACTIONCLASS           TEXT,            RESULT                INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, TIME)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "Windows10.0-KB5001716-x64",
        "indexsqlite_autoindex_ACTIONRECORDS_1ACTIONRECORDS",
        "tableUPDATESUPDATES",
        "Windows Dictionary Updates for Simplified Chinese, Japanese Input Methods and English (US) Bing trendy words.",
        "indexsqlite_autoindex_UPDATES_1UPDATES",
        "Z9hjeCT4PU68IusV.1.1",
        "Category for Windows Ultimate Extras",
        "indexsqlite_autoindex_PROVIDERSPROP_1PROVIDERSPROP",
        "50c04525-9b15-4f7c-bed4-87455bcd7ded",
        "Windows Media Dynamic Installer",
        "Windows Media Setup Updates",
        "e88a19fb-a847-4e3d-9ae2-13c2b84f58a6",
        "Windows Ultimate Extras",
        "405706ed-f1d7-47ea-91e1-eb8860039715",
        "tableACTIONRECORDSACTIONRECORDS",
        "http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/WindowsInstaller",
        "25623350-1c13-4874-84fb-63d7ef37daa6",
        "CREATE TABLE UPDATESPROP (            PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID   TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            VARIABLE   TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, VARIABLE)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "ca006cfb-49eb-439b-880a-1312e1fc9713",
        "tableVARIABLESVARIABLES",
        "72e7624a-5b00-45d2-b92f-e561c0a6a160",
        "Windows Dictionary Updates",
        "Windows Security service and user interface.",
        "MoUpdateOrchestrator",
        "Windows Security platform",
        "CREATE TABLE UPDATES (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            SERIALIZEDUPDATE      BLOB,            PRIMARY KEY(PROVIDERID, UPDATEID))",
        "Windows 11",
        "IsUpgradeRepair",
        "indexsqlite_autoindex_UPDATESPROP_1UPDATESPROP",
        "indexsqlite_autoindex_VARIABLES_1VARIABLES",
        "Windows Insider Pre-Release",
        "SQLite format 3",
        "Product",
        "478e0fe9-52e9-4ebd-b70a-bbb0462a2e54"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": ""
    },
    {
      "name": [
        "store.db-journal"
      ],
      "path": "/opt/CAPEv2/storage/analyses/17/files/418e6950457c5d3dc17c89249ac7da769bbbcbf2247411e8898f511f45c65624",
      "guest_paths": [
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "size": 8720,
      "crc32": "A570BFE7",
      "md5": "cfd115812271344ba218e54231673376",
      "sha1": "852068fcabfd4576c5be3ab839edbec8678c1d06",
      "sha256": "418e6950457c5d3dc17c89249ac7da769bbbcbf2247411e8898f511f45c65624",
      "sha512": "0e9f9944a81c0ac76c414e09eb9df5573815203cad5321edcdc031775e4c35d8caa1c1f4af2c976eff567994447091a5b53343447a000c21fc82d8a4c820b504",
      "rh_hash": null,
      "ssdeep": "96:7M5TkB+Bd5d0wh89j9YrKd91zJr5gwtjaG9G5OGFGnGiesG9GURGzn4:7M5Two0O89ZYuFzJr5fSK4",
      "type": "SQLite Rollback Journal",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T1A7027B247AFC2225E1B3B9F99FF8C446CA27B5651937DA1F102E024B0BD7E019D51735",
      "sha3_384": "b1d5c36ed176a87ef169c35eb3b6a1499b3a08a3e32c01ce37348d724e9e2835218709114bc68ae0015aeb22b6865a03",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10",
      "data": null,
      "strings": [
        "657943f1-1efb-430a-a6c8-f77993103709",
        "tableUPDATESPROPUPDATESPROP",
        "uded in this update, see the associated Microsoft Knowledge Base article. After you install this update, you may have to restart your system.",
        "CREATE TABLE VARIABLES (            KEY        TEXT NOT NULL COLLATE NOCASE CHECK(KEY <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(KEY))",
        "9hjeCT4PU68IusV.1.1",
        "{\"BuildFlightID\":\"RS:18F4F\", \"BuildFlightVersion\":\"10.0.19041.3626\"}",
        "indexsqlite_autoindex_ACTIONRECORDS_1ACTIONRECORDS",
        "CREATE TABLE ACTIONRECORDS (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            TIME                  TEXT,            ACTION                TEXT,            ACTIONCLASS           TEXT,            RESULT                INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, TIME)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "tableUPDATESUPDATES",
        "indexsqlite_autoindex_UPDATES_1UPDATES",
        "Z9hjeCT4PU68IusV.1.1",
        "RS:18F4F",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4b3a45b1-1a01-4c3f-8330-18bcfd342b14?P1=1779985046&P2=404&P3=2&P4=PCzA6oWbZPpn8pRpKbd%2fGBx7DXsCwcecPWscGcJVKSxPsf3XFgS3cXpsOhGqTBwcGrZ%2fdv2Ow1WaX6wtyGOh8Q%3d%3d",
        "indexsqlite_autoindex_PROVIDERSPROP_1PROVIDERSPROP",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/31568bc2-a514-408d-beb6-1439e703c889?P1=1779985086&P2=404&P3=2&P4=Gud8NZVK6WQ8V7jAypiuLs7m4pYAwWKEdwGZVDsr30Rd%2fUkUhfNd0dxJrBfvObX8RT1a5tWlzclq4%2feB%2fa1niA%3d%3d",
        "4023057",
        "Critical Updates",
        "e6cf1350-c01b-414d-a61f-263d14d133b4",
        "tableACTIONRECORDSACTIONRECORDS",
        "CREATE TABLE UPDATESPROP (            PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID   TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            VARIABLE   TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, VARIABLE)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "SedimentPack.amd64",
        "2023-10 Update for Windows 10 Version 22H2 for x64-based Systems (KB4023057)",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a8821f7f-f5b3-4a84-99d5-9d563b6adb99?P1=1779985046&P2=404&P3=2&P4=PwM0Eqtl9a%2bTnFg6dGkmnClSJ7ZIwO4C1oPVN5W3JEiyklVfBB550yE88Bg%2futN7hvbQ%2fi8eDV3M7vAi8QO9%2bg%3d%3d",
        "tableVARIABLESVARIABLES",
        "A broadly released fix for a specific problem addressing a critical, non-security related bug.",
        "MoUpdateOrchestrator",
        "CREATE TABLE UPDATES (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            SERIALIZEDUPDATE      BLOB,            PRIMARY KEY(PROVIDERID, UPDATEID))",
        "https://support.microsoft.com/help/4023057",
        "http://tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/af74329d-b580-45ba-98c8-34bf4f27f853?P1=1779985046&P2=404&P3=2&P4=iGccOaZuo29U23CN%2b71qrYiGakBFqNsbGvSk6UdDIjK98QBwWeWrlZCKe3ipRh%2fuiE8iA34AuLelCiZ2T5PmSg%3d%3d",
        "IsUpgradeRepair",
        "indexsqlite_autoindex_UPDATESPROP_1UPDATESPROP",
        "indexsqlite_autoindex_VARIABLES_1VARIABLES",
        "SQLite format 3",
        "UpdateClassification",
        "http://schemas.microsoft.com/msus/2016/01/UpdateHandlers/OSInstaller"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": ""
    },
    {
      "name": [
        "store.db-journal"
      ],
      "path": "/opt/CAPEv2/storage/analyses/17/files/5459aaa7b94b326d2321e6e5a992ca0a4a9d36780f94b66fac585854ed582f5a",
      "guest_paths": [
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "size": 8720,
      "crc32": "51DCC0AD",
      "md5": "658ecb3a73a91bb2605ccd49f2fe04d7",
      "sha1": "371ae92764d46218b537f647b9df83cb51370227",
      "sha256": "5459aaa7b94b326d2321e6e5a992ca0a4a9d36780f94b66fac585854ed582f5a",
      "sha512": "8fdfe2ab2c9f68ebd272c34354b1020ff50485dfb5900fd0c0bea04a68aa0b2acf62775d7b5d2f8acd7bbb5420a99f95720128a0413fc81b4b6666beb0a7cc3f",
      "rh_hash": null,
      "ssdeep": "96:7RK87eyyNwbQLhM+bUegHSxYUbHdFdIMs6G9G5OGFGnGiesG9GURGzns:7RTx02lHZUbHdFdtsyKs",
      "type": "SQLite Rollback Journal",
      "yara": [],
      "cape_yara": [],
      "clamav": [],
      "tlsh": "T183023214B7EC2114E273B6F59FF8D445CB27BAA51A3BD61F201D428B0B93E019E61B36",
      "sha3_384": "9d730e4e30939c70ea93f20f32fd542dccc360a82332b2cc1b99d69011535e8c3a2d3540176f325e520947af37c2b4fe",
      "yara_hash": "05ddd2ba6af91c0093e6b2dd9d4e664e1d0c5f1a80b80cc3cd41b1840ed26afe",
      "options_hash": "ca3760a7292cd3fa077daf6ff5eacbed9d31b472fec95e5f2c9cfb0a258ecd10",
      "data": null,
      "strings": [
        "tableUPDATESPROPUPDATESPROP",
        "This new category will be used for all future pre-release feature update publishes to WSUS, primarily for SCCM consumption.",
        "CREATE TABLE VARIABLES (            KEY        TEXT NOT NULL COLLATE NOCASE CHECK(KEY <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(KEY))",
        "e7441a84-4561-465f-9e0e-7fc16fa25ea7",
        "9hjeCT4PU68IusV.1.1",
        "2d2a68ab-50ca-4d80-b96c-757bc32024c7",
        "CREATE TABLE ACTIONRECORDS (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            TIME                  TEXT,            ACTION                TEXT,            ACTIONCLASS           TEXT,            RESULT                INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, TIME)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "indexsqlite_autoindex_ACTIONRECORDS_1ACTIONRECORDS",
        "tableUPDATESUPDATES",
        "indexsqlite_autoindex_UPDATES_1UPDATES",
        "Z9hjeCT4PU68IusV.1.1",
        "db5bac0b-a277-4d18-9bfd-6c9b08e3251c",
        "Category for Windows Ultimate Extras",
        "indexsqlite_autoindex_PROVIDERSPROP_1PROVIDERSPROP",
        "Windows Media Dynamic Installer",
        "Windows Media Setup Updates",
        "Windows Ultimate Extras",
        "e88a19fb-a847-4e3d-9ae2-13c2b84f58a6",
        "28bc880e-0592-4cbf-8f95-c79b17911d5f",
        "tableACTIONRECORDSACTIONRECORDS",
        "CREATE TABLE UPDATESPROP (            PROVIDERID TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID   TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            VARIABLE   TEXT NOT NULL COLLATE NOCASE CHECK(VARIABLE <> ''),            VALUE      TEXT,            TYPE       INTEGER,            PRIMARY KEY(PROVIDERID, UPDATEID, VARIABLE)            FOREIGN KEY(PROVIDERID, UPDATEID) REFERENCES UPDATES(PROVIDERID, UPDATEID) ON DELETE CASCADE)",
        "A tested, cumulative set of hotfixes, security updates, critical updates, and updates packaged together for easy deployment. A rollup generally targets a specific area, such as security, or a component of a product, such as Internet Information Services \"IIS\".",
        "2bb858ab-eb18-4b20-becd-d4d16caa73f3",
        "ca006cfb-49eb-439b-880a-1312e1fc9713",
        "tableVARIABLESVARIABLES",
        "Windows Security service and user interface.",
        "http://schemas.microsoft.com/msus/2002/12/UpdateHandlers/CommandLineInstallation",
        "Insider Pre-Release",
        "MoUpdateOrchestrator",
        "Windows Security platform",
        "Windows Malicious Software Removal Tool - v5.141 (KB890830) Multi-Lingual - v5 full",
        "CREATE TABLE UPDATES (            PROVIDERID            TEXT NOT NULL COLLATE NOCASE CHECK(PROVIDERID <> ''),            UPDATEID              TEXT NOT NULL COLLATE NOCASE CHECK(UPDATEID <> ''),            SERIALIZEDUPDATE      BLOB,            PRIMARY KEY(PROVIDERID, UPDATEID))",
        "IsUpgradeRepair",
        "indexsqlite_autoindex_UPDATESPROP_1UPDATESPROP",
        "Update Rollups",
        "indexsqlite_autoindex_VARIABLES_1VARIABLES",
        "http://download.windowsupdate.com/c/msdownload/update/software/uprl/2026/05/windows-kb890830-x64-v5.141_28e375ae266a48518b85561b124c6d21b82d84a6.exe",
        "SQLite format 3",
        "Product",
        "UpdateClassification"
      ],
      "virustotal": {
        "error": true,
        "msg": "Unable to complete connection to VirusTotal. Status code: 429"
      },
      "executed_tools": [
        "msi_extract",
        "overlay",
        "kixtart_extract",
        "vbe_extract",
        "batch_extract",
        "UnAutoIt_extract",
        "UPX_unpack",
        "RarSFX_extract",
        "Inno_extract",
        "SevenZip_unpack",
        "de4dot_deobfuscate",
        "eziriz_deobfuscate",
        "office_one"
      ],
      "cape_type_code": 0,
      "cape_type": "",
      "pid": ""
    }
  ],
  "CAPE": {
    "payloads": [],
    "configs": []
  },
  "info": {
    "version": "2.5",
    "started": "2026-05-28 18:31:38",
    "ended": "2026-05-28 18:33:15",
    "duration": 97,
    "id": 17,
    "category": "url",
    "custom": "",
    "machine": {
      "id": 13,
      "status": "stopping",
      "name": "cuckoo1",
      "label": "cuckoo1",
      "platform": "windows",
      "manager": "KVM",
      "started_on": "2026-05-28 18:31:38",
      "shutdown_on": "2026-05-28 18:33:15"
    },
    "package": "edge",
    "timeout": false,
    "tlp": null,
    "parent_sample": null,
    "options": {
      "interactive": "1",
      "nohuman": "yes",
      "vnc_port": "5910"
    },
    "source_url": null,
    "route": "none",
    "user_id": 1,
    "CAPE_current_commit": "e261551257b77d1ae36b689efcf9b3d0af4476c2"
  },
  "behavior": {
    "processes": [
      {
        "process_id": 4676,
        "process_name": "explorer.exe",
        "parent_id": 4608,
        "module_path": "C:\\Windows\\explorer.exe",
        "first_seen": "2026-05-28 22:31:44,383",
        "calls": [
          {
            "timestamp": "2026-05-28 22:31:49,633",
            "thread_id": "6208",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff98cc16e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002134"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:31:51,524",
            "thread_id": "6208",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002690"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:31:51,524",
            "thread_id": "6208",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002688"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:31:51,524",
            "thread_id": "5300",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002694"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07df0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x081ef620"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:31:51,524",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002134"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:31:51,571",
            "thread_id": "5468",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff9706aff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:31:54,586",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:31:54,618",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002200"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:31:54,664",
            "thread_id": "5468",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:31:54,680",
            "thread_id": "4824",
            "caller": "0x7ff663a28fba",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:31:54,680",
            "thread_id": "4824",
            "caller": "0x7ff663a28fba",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:31:54,680",
            "thread_id": "5468",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:31:54,680",
            "thread_id": "4900",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:31:54,680",
            "thread_id": "5160",
            "caller": "0x7ff66398f2e2",
            "parentcaller": "0x7ff66398f1d3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:31:54,680",
            "thread_id": "4900",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:31:54,696",
            "thread_id": "4824",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000960"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0161f8d0"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:31:54,696",
            "thread_id": "4900",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:31:54,711",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:31:54,711",
            "thread_id": "4900",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:31:54,711",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:31:54,711",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000269c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:31:54,711",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000229c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:31:54,727",
            "thread_id": "5300",
            "caller": "0x7fff97069794",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F6C29334-47DC-4397-9150-F549CF1D4861"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:31:54,727",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:31:54,727",
            "thread_id": "5300",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000229c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x081ee460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:31:54,727",
            "thread_id": "5300",
            "caller": "0x7fff97069794",
            "parentcaller": "0x7fff90dcb1dd",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F6C29334-47DC-4397-9150-F549CF1D4861"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:31:54,727",
            "thread_id": "8044",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002698"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:31:54,727",
            "thread_id": "5300",
            "caller": "0x7fff97069794",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F6C29334-47DC-4397-9150-F549CF1D4861"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:31:54,774",
            "thread_id": "5300",
            "caller": "0x7fff96524448",
            "parentcaller": "0x7fff9384d2de",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x04b93000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:31:54,789",
            "thread_id": "6168",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002684"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:31:54,789",
            "thread_id": "4900",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000026a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0350f460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:31:54,789",
            "thread_id": "5160",
            "caller": "0x7ff6639911b7",
            "parentcaller": "0x7ff6639914a4",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "95B63696-18B6-4D3E-8EC2-CDB4352318EB"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "5FEFBB8E-82C3-4EC4-93A0-05C4B9FCD4CD"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:31:55,446",
            "thread_id": "4900",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000022a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0350f460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:31:55,461",
            "thread_id": "4900",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002094"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0350f460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:31:55,461",
            "thread_id": "5300",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000026a8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x081ee460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:31:55,461",
            "thread_id": "5300",
            "caller": "0x7fff97069794",
            "parentcaller": "0x7fff90dcb1dd",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F6C29334-47DC-4397-9150-F549CF1D4861"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:31:55,477",
            "thread_id": "5456",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000026a8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x09d7f600"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:31:55,477",
            "thread_id": "5300",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000026a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x081ee460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:31:55,477",
            "thread_id": "5300",
            "caller": "0x7fff97069794",
            "parentcaller": "0x7fff90dcb1dd",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F6C29334-47DC-4397-9150-F549CF1D4861"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:31:56,539",
            "thread_id": "6208",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff98cc16e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002288"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "5300",
            "caller": "0x7fff7ff4552f",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "17541A17-F509-4CB6-8D08-651DC68D8227"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff9705acd6",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "6208",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:31:57,258",
            "thread_id": "4840",
            "caller": "0x7fff82a93ede",
            "parentcaller": "0x7fff984ed492",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:31:57,274",
            "thread_id": "4840",
            "caller": "0x7fff9766a7f7",
            "parentcaller": "0x7fff97669037",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00021401-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E4-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": "lnkfile"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:31:57,274",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000020f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:31:57,274",
            "thread_id": "4840",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000228c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0338d480"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5300",
            "caller": "0x7fff7ff4552f",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "17541A17-F509-4CB6-8D08-651DC68D8227"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5700",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff9705acd6",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "6208",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5700",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5700",
            "caller": "0x7fff82a93ede",
            "parentcaller": "0x7fff984ed492",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5700",
            "caller": "0x7fff9766a7f7",
            "parentcaller": "0x7fff97669037",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00021401-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E4-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": "lnkfile"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:31:58,993",
            "thread_id": "5700",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000022ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b2fd840"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff94524fbc",
            "parentcaller": "0x7fff9451f4db",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff9701f303",
            "parentcaller": "0x7fff9701e7f3",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff94524fbc",
            "parentcaller": "0x7fff9451f4db",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96f97b67",
            "parentcaller": "0x7fff96f97add",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff9654c32f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002630"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msinfo32.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msinfo32.exe"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 2,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000033",
            "pretty_return": "OBJECT_NAME_INVALID",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000d0010"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msinfo32.exe\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x7fff98b67344"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff965070c7",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff9650693c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff86b45ccf",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002668"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff86b46ced",
            "parentcaller": "0x7fff86b4816c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D"
              },
              {
                "name": "ClsContext",
                "value": "0x00100004",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_CLOAKING"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96f97b67",
            "parentcaller": "0x7fff96f97add",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff9654c32f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 2,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000033",
            "pretty_return": "OBJECT_NAME_INVALID",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00020010"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x7fff98b67344"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:31:59,008",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000262c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff965070c7",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff9650693c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002624"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff86b45ccf",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002624"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff86b46ced",
            "parentcaller": "0x7fff86b4816c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D"
              },
              {
                "name": "ClsContext",
                "value": "0x00100004",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_CLOAKING"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff97671e0e",
            "parentcaller": "0x7fff9765992c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CDC82860-468D-4D4E-B7E7-C298FF23AB2C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "5632B1A4-E38A-400A-928A-D4CD63230295"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff944d574b",
            "parentcaller": "0x7fff944d50a2",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F1C46D71-B791-4110-8D5C-7108F22C1010"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8A43ED9F-F4E6-4421-ACF9-1DAB2986820C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff94632c3e",
            "parentcaller": "0x7fff944d5105",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "6208",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "4824",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "4824",
            "caller": "0x7fff945e9aa2",
            "parentcaller": "0x7fff945eac92",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff9448764e",
            "parentcaller": "0x7fff94487552",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DD313E04-FEFF-11D1-8ECD-0000F87A470C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "49B36D57-5FD2-45A7-981B-06028D577A47"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff96f924ea",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff984c5341",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00002620",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x0a326420"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "8336"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:31:59,024",
            "thread_id": "5700",
            "caller": "0x7fff9654f430",
            "parentcaller": "0x7fff984c5379",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00002620"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "8336"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "5700",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00002610"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00002620"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\msinfo32.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "8372"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fcf4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fcf7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fcfc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fcff000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd08000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd0d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:31:59,039",
            "thread_id": "6208",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd13000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5700",
            "caller": "0x7fff96529666",
            "parentcaller": "0x7fff98b6cec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\msinfo32.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              },
              {
                "name": "CreationFlags",
                "value": "0x04080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT|CREATE_DEFAULT_ERROR_MODE"
              },
              {
                "name": "ProcessId",
                "value": "8372"
              },
              {
                "name": "ThreadId",
                "value": "7460"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00002610"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00002620"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5460",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5700",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5700",
            "caller": "0x7fff9448e607",
            "parentcaller": "0x7fff9459a545",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5300",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000262c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x081ed3e0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5700",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7c40170e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\sfc_os.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d70000"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002670"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5700",
            "caller": "0x7fff84d71284",
            "parentcaller": "0x7fff84d7113e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002668"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WinSxS\\FileMaps\\$$_system32_21f9a9c4a2f8b514.cdf-ms"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5700",
            "caller": "0x7fff84d713fd",
            "parentcaller": "0x7fff84d712af",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002608"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45bc40000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000b7000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:31:59,055",
            "thread_id": "5700",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd16000"
              },
              {
                "name": "RegionSize",
                "value": "0x00029000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5700",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd3f000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5700",
            "caller": "0x7fff84d714f9",
            "parentcaller": "0x7fff84d711ec",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45bc40000"
              },
              {
                "name": "RegionSize",
                "value": "0x000b7000"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "4900",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000266c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0350f460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5496",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002204"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0330f240"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5160",
            "caller": "0x7ff66398590b",
            "parentcaller": "0x7ff6639876b1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\windows.internal.shell.broker"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7c210000"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5160",
            "caller": "0x7ff66398590b",
            "parentcaller": "0x7ff6639876b1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c210000"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5160",
            "caller": "0x7ff663987547",
            "parentcaller": "0x7ff6639873a0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "6208",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5160",
            "caller": "0x7ff6639f9973",
            "parentcaller": "0x7ff6639f97dc",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5160",
            "caller": "0x7ff6639f9973",
            "parentcaller": "0x7ff6639f97dc",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5300",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000025d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x081ee460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "5300",
            "caller": "0x7fff97069794",
            "parentcaller": "0x7fff90dcb1dd",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F6C29334-47DC-4397-9150-F549CF1D4861"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:31:59,071",
            "thread_id": "4900",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000266c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0350f460"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "8336",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000025c8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "5700",
            "caller": "0x7fff9654f430",
            "parentcaller": "0x7fff94582a9b",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00002620"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "7460"
              },
              {
                "name": "ProcessId",
                "value": "8372"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "5700",
            "caller": "0x7fff977903fa",
            "parentcaller": "0x7fff976405cb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000266c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000004"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop\\%1"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000266c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000004"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop\\%1"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:31:59,102",
            "thread_id": "5700",
            "caller": "0x7fff9701f303",
            "parentcaller": "0x7fff9701e7f3",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:31:59,305",
            "thread_id": "5388",
            "caller": "0x7fff96542a0c",
            "parentcaller": "0x7fff82acf12b",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:31:59,305",
            "thread_id": "5388",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:31:59,305",
            "thread_id": "5388",
            "caller": "0x7fff91ebc1d6",
            "parentcaller": "0x7fff91ebbde6",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5300",
            "caller": "0x7fff81bce757",
            "parentcaller": "0x7fff8187686e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5300",
            "caller": "0x7fff96542a0c",
            "parentcaller": "0x7fff82acf12b",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000229c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5300",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001b4c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5300",
            "caller": "0x7fff83bfc07b",
            "parentcaller": "0x7fff83bfc564",
            "category": "com",
            "api": "CoCreateInstance",
            "status": false,
            "return": "0xffffffff8001010d",
            "arguments": [
              {
                "name": "rclsid",
                "value": "3480A401-BDE9-4407-BC02-798A866AC051"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "0F4ACCB1-D8F9-4011-BA37-2557925A78CF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5300",
            "caller": "0x7fff83bfc12b",
            "parentcaller": "0x7fff83bfc564",
            "category": "com",
            "api": "CoCreateInstance",
            "status": false,
            "return": "0xffffffff8001010d",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5160",
            "caller": "0x7ff6639eb354",
            "parentcaller": "0x7ff6639eb12e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "4900",
            "caller": "0x7ff6639ac67f",
            "parentcaller": "0x7ff6639ac407",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000025ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45b910000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "6208",
            "caller": "0x7ff6639e99ca",
            "parentcaller": "0x7ff6639ea869",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002214"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002218"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000001"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff94524fbc",
            "parentcaller": "0x7fff9451f4db",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96f97b67",
            "parentcaller": "0x7fff96f97add",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff9654c32f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002214"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msinfo32.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002214"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msinfo32.exe"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002130"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000033",
            "pretty_return": "OBJECT_NAME_INVALID",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00030010"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msinfo32.exe\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x7fff976c207c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5496",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff96506fe6",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002634"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4900",
            "caller": "0x7fff96523013",
            "parentcaller": "0x7fff7f3b672b",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000018dc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0c\\xaf\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff96506fe6",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff965070c7",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff9650693c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5496",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff945258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002214"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff86b45ccf",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002214"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5496",
            "caller": "0x7fff94525882",
            "parentcaller": "0x7fff94528f55",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4234D49B-0245-4DF3-B780-3893943456E1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E6-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5496",
            "caller": "0x7fff82a758e1",
            "parentcaller": "0x7fff82a75ef1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "02C5CCF3-805F-4654-A7B7-340A74335365"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639e8f2b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639e8f2b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "4840",
            "caller": "0x7fff86b46ced",
            "parentcaller": "0x7fff86b4816c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D"
              },
              {
                "name": "ClsContext",
                "value": "0x00100004",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_CLOAKING"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000025f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b2fd750"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96f97b67",
            "parentcaller": "0x7fff96f97add",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "79EAC9EE-BAF9-11CE-8C82-00AA004BA90B"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff9654c32f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff98b642c4",
            "parentcaller": "0x7fff98b63b55",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002218"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msinfo32.exe"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff98b644a6",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000025ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x10de0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00067000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4824",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000269c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff98b646a1",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x10de0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00067000"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff98cd290d",
            "parentcaller": "0x7fff98c635db",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff96506fe6",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000033",
            "pretty_return": "OBJECT_NAME_INVALID",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00050010"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4824",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x7fff976c207c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff965486ed",
            "parentcaller": "0x7fff7fff9455",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000021e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff96506fe6",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000269c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff80004639",
            "parentcaller": "0x7fff800045ca",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000259c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b2fd940"
              },
              {
                "name": "ViewSize",
                "value": "0x0000f000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001b4c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff965486ed",
            "parentcaller": "0x7fff7fff9455",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002608"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002608"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x114d0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b2fdaf0"
              },
              {
                "name": "ViewSize",
                "value": "0x00100000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff80001d16",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000025ac"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002218"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "5700",
            "caller": "0x7fff80004639",
            "parentcaller": "0x7fff800045ca",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506c28",
            "parentcaller": "0x7fff96506f7c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 1,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505cb3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff965070c7",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96504d82",
            "parentcaller": "0x7fff9650693c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120080",
                "pretty_value": "FILE_READ_ATTRIBUTES|READ_CONTROL|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "4840",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff86b45ccf",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002610"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4840",
            "caller": "0x7fff86b46ced",
            "parentcaller": "0x7fff86b4816c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "A463FCB9-6B1C-4E0D-A80B-A2CA7999E25D"
              },
              {
                "name": "ClsContext",
                "value": "0x00100004",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_CLOAKING"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4840",
            "caller": "0x7fff97671e0e",
            "parentcaller": "0x7fff9765992c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CDC82860-468D-4D4E-B7E7-C298FF23AB2C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "5632B1A4-E38A-400A-928A-D4CD63230295"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4840",
            "caller": "0x7fff944d574b",
            "parentcaller": "0x7fff944d50a2",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F1C46D71-B791-4110-8D5C-7108F22C1010"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8A43ED9F-F4E6-4421-ACF9-1DAB2986820C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4840",
            "caller": "0x7fff94632c3e",
            "parentcaller": "0x7fff944d5105",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "5216",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4824",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4824",
            "caller": "0x7fff945e9aa2",
            "parentcaller": "0x7fff945eac92",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:31:59,383",
            "thread_id": "4840",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00002610"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001b4c"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\msinfo32.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "2380"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "4840",
            "caller": "0x7fff96529666",
            "parentcaller": "0x7fff98b6cec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\msinfo32.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              },
              {
                "name": "CreationFlags",
                "value": "0x04080414",
                "pretty_value": "CREATE_SUSPENDED|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT|CREATE_DEFAULT_ERROR_MODE"
              },
              {
                "name": "ProcessId",
                "value": "2380"
              },
              {
                "name": "ThreadId",
                "value": "2404"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00002610"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001b4c"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "4840",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7c40170e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\sfc_os.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d70000"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "4840",
            "caller": "0x7fff84d71284",
            "parentcaller": "0x7fff84d7113e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002184"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WinSxS\\FileMaps\\$$_system32_21f9a9c4a2f8b514.cdf-ms"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "4840",
            "caller": "0x7fff84d713fd",
            "parentcaller": "0x7fff84d712af",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002204"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45bc40000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000b7000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "4840",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd4c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00029000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "4840",
            "caller": "0x7fff84d714f9",
            "parentcaller": "0x7fff84d711ec",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45bc40000"
              },
              {
                "name": "RegionSize",
                "value": "0x000b7000"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4840",
            "caller": "0x7fff9654f430",
            "parentcaller": "0x7fff94582a9b",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00001b4c"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "2404"
              },
              {
                "name": "ProcessId",
                "value": "2380"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4840",
            "caller": "0x7fff977903fa",
            "parentcaller": "0x7fff976405cb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000004"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\Desktop\\%1"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000004"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\Public\\Desktop\\%1"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4840",
            "caller": "0x7fff9701f303",
            "parentcaller": "0x7fff9701e7f3",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "5160",
            "caller": "0x7ff6639eb354",
            "parentcaller": "0x7ff6639eb12e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "6208",
            "caller": "0x7ff6639e99ca",
            "parentcaller": "0x7ff6639ea869",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639e8f2b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001b4c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:31:59,571",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "5388",
            "caller": "0x7fff96542a0c",
            "parentcaller": "0x7fff82acf12b",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "5388",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "5300",
            "caller": "0x7fff81bce757",
            "parentcaller": "0x7fff8187686e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "5300",
            "caller": "0x7fff96542a0c",
            "parentcaller": "0x7fff82acf12b",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "5300",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002598"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "5300",
            "caller": "0x7fff83bfc07b",
            "parentcaller": "0x7fff83bfc564",
            "category": "com",
            "api": "CoCreateInstance",
            "status": false,
            "return": "0xffffffff8001010d",
            "arguments": [
              {
                "name": "rclsid",
                "value": "3480A401-BDE9-4407-BC02-798A866AC051"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "0F4ACCB1-D8F9-4011-BA37-2557925A78CF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "5300",
            "caller": "0x7fff83bfc12b",
            "parentcaller": "0x7fff83bfc564",
            "category": "com",
            "api": "CoCreateInstance",
            "status": false,
            "return": "0xffffffff8001010d",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "5160",
            "caller": "0x7ff6639eb354",
            "parentcaller": "0x7ff6639eb12e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "6208",
            "caller": "0x7ff6639e99ca",
            "parentcaller": "0x7ff6639ea869",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "4900",
            "caller": "0x7ff6639aca89",
            "parentcaller": "0x7ff6639ac93f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\apppatch\\sysmain.sdb"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "4900",
            "caller": "0x7ff6639ac67f",
            "parentcaller": "0x7ff6639ac407",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000226c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45b910000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002184"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "4900",
            "caller": "0x7ff6639aa878",
            "parentcaller": "0x7ff6639aa7ba",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45b910000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000226c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000226c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002610"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002598"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002598"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x01"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002580"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "6208",
            "caller": "0x7ff663b1db8b",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "process",
            "api": "WriteProcessMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x00fb4281"
              },
              {
                "name": "Buffer",
                "value": "\\x00"
              },
              {
                "name": "BufferLength",
                "value": "0x00000001"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639e8f2b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639e8f2b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "6272",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "8044",
            "caller": "0x7fff7dfe4428",
            "parentcaller": "0x7fff7dfe3a03",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F0AE1542-F497-484B-A175-A20DB09144BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8DC24A1A-6314-4769-9D68-179786F4CED6"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5496",
            "caller": "0x7fff96523013",
            "parentcaller": "0x7fff7f3b672b",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000018dc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0c\\xaf\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "8044",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff945258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "8044",
            "caller": "0x7fff94525882",
            "parentcaller": "0x7fff94528f55",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4234D49B-0245-4DF3-B780-3893943456E1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E6-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "8044",
            "caller": "0x7fff82a758e1",
            "parentcaller": "0x7fff82a75ef1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "02C5CCF3-805F-4654-A7B7-340A74335365"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:31:59,789",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:31:59,789",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "5300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5388",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002598"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5160",
            "caller": "0x7ff6639eb354",
            "parentcaller": "0x7ff6639eb12e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "6208",
            "caller": "0x7ff6639e99ca",
            "parentcaller": "0x7ff6639ea869",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5388",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "4900",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002184"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45b910000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x003e3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "6208",
            "caller": "0x7ff6639ebdd2",
            "parentcaller": "0x7ff6639ea52a",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "6208",
            "caller": "0x7ff6639ea552",
            "parentcaller": "0x7ff6639e9a4f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "4900",
            "caller": "0x7ff6639aa878",
            "parentcaller": "0x7ff6639aa7ba",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7df45b910000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e3000"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639e8f2b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639e8f2b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "6272",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "8044",
            "caller": "0x7fff7dfe4428",
            "parentcaller": "0x7fff7dfe3a03",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F0AE1542-F497-484B-A175-A20DB09144BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8DC24A1A-6314-4769-9D68-179786F4CED6"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 1,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "8044",
            "caller": "0x7fff94525882",
            "parentcaller": "0x7fff94528f55",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4234D49B-0245-4DF3-B780-3893943456E1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E6-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "8044",
            "caller": "0x7fff82a758e1",
            "parentcaller": "0x7fff82a75ef1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "02C5CCF3-805F-4654-A7B7-340A74335365"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002184"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4900",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aad3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4900",
            "caller": "0x7fff96523013",
            "parentcaller": "0x7fff7f3b672b",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000018dc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\GameDVR\\KnownGameList.bin"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x0c\\xaf\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4840",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4840",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000026a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07e10000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0338d390"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4840",
            "caller": "0x7ff6639b0b6a",
            "parentcaller": "0x7ff6639b0a51",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4840",
            "caller": "0x7ff6639b0b6a",
            "parentcaller": "0x7ff6639b0a51",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000026a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x139a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00505000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4840",
            "caller": "0x7ff6639b0b6a",
            "parentcaller": "0x7ff6639b0a51",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4840",
            "caller": "0x7ff6639b0b6a",
            "parentcaller": "0x7ff6639b0a51",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x139a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00505000"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "4840",
            "caller": "0x7ff6639b0b6a",
            "parentcaller": "0x7ff6639b0a51",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:31:59,852",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:31:59,868",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:31:59,868",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:31:59,899",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:31:59,899",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:31:59,930",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:31:59,930",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:31:59,946",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:31:59,946",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:31:59,961",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:31:59,961",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:31:59,977",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:31:59,977",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:31:59,993",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:31:59,993",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:32:00,024",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:32:00,024",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:32:00,852",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:32:00,852",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:32:00,852",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000026a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:32:00,852",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:32:00,852",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:32:00,852",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002200"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:32:00,852",
            "thread_id": "5456",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:32:00,883",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:32:00,883",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:32:00,899",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:32:00,899",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:32:00,914",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:32:00,914",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "5388",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000226c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "5388",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002178"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000226c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "6272",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "5456",
            "caller": "0x7fff7dfe4428",
            "parentcaller": "0x7fff7dfe3a03",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F0AE1542-F497-484B-A175-A20DB09144BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8DC24A1A-6314-4769-9D68-179786F4CED6"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:32:00,930",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:32:00,946",
            "thread_id": "5456",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff945258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:32:00,946",
            "thread_id": "5456",
            "caller": "0x7fff94525882",
            "parentcaller": "0x7fff94528f55",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4234D49B-0245-4DF3-B780-3893943456E1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E6-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:32:00,946",
            "thread_id": "5456",
            "caller": "0x7fff82a758e1",
            "parentcaller": "0x7fff82a75ef1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "02C5CCF3-805F-4654-A7B7-340A74335365"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:32:01,102",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:32:01,102",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:32:01,118",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:32:01,118",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:32:01,133",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:32:01,133",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:32:01,196",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:32:01,196",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:32:01,211",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:32:01,211",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:32:02,243",
            "thread_id": "5160",
            "caller": "0x7ff663bd49d7",
            "parentcaller": "0x7ff663bd0d5a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:32:02,243",
            "thread_id": "5216",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:32:02,243",
            "thread_id": "4824",
            "caller": "0x7ff663a28fba",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:32:02,243",
            "thread_id": "4824",
            "caller": "0x7ff663a28fba",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:32:02,258",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:32:02,289",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:32:02,289",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002288"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:32:02,305",
            "thread_id": "4824",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:32:03,289",
            "thread_id": "5160",
            "caller": "0x7ff663bb1da0",
            "parentcaller": "0x7ff663bd18bb",
            "category": "windows",
            "api": "SendNotifyMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010608"
              },
              {
                "name": "Message",
                "value": "0x00000112"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "6272",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "4824",
            "caller": "0x7fff7dfe4428",
            "parentcaller": "0x7fff7dfe3a03",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F0AE1542-F497-484B-A175-A20DB09144BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8DC24A1A-6314-4769-9D68-179786F4CED6"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "5160",
            "caller": "0x7ff663a97be7",
            "parentcaller": "0x7ff663a94fa0",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97dd7",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97dd7",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002204"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "5160",
            "caller": "0x7ff663a97e2d",
            "parentcaller": "0x7ff663a94fa0",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000259c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aaf4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aaf7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aafc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aaff000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ab04000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9c53a",
            "parentcaller": "0x7ff663a97e74",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ab07000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9c03e",
            "parentcaller": "0x7ff663a9b13b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ab0c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd75000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fdb8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fdfb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fe04000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fe47000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fe50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ab0f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ab12000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fe59000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:32:03,336",
            "thread_id": "5160",
            "caller": "0x7ff663a9de16",
            "parentcaller": "0x7ff663a9c0ee",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fe6a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "5160",
            "caller": "0x7ff6639f984c",
            "parentcaller": "0x7ff6639f97dc",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aa61000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "5160",
            "caller": "0x7ff6639f984c",
            "parentcaller": "0x7ff6639f97dc",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aab0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "5160",
            "caller": "0x7ff6639f984c",
            "parentcaller": "0x7ff6639f97dc",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aaf3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "5160",
            "caller": "0x7ff6639f984c",
            "parentcaller": "0x7ff6639f97dc",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aaf7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "5160",
            "caller": "0x7ff6639f984c",
            "parentcaller": "0x7ff6639f97dc",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000266c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002204"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "6204",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0ddfc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "6200",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fe3e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:32:03,352",
            "thread_id": "6196",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd24000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:32:03,821",
            "thread_id": "6204",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:32:03,821",
            "thread_id": "6204",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fd1c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:32:03,821",
            "thread_id": "5216",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:32:03,821",
            "thread_id": "6184",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:32:03,821",
            "thread_id": "6184",
            "caller": "0x7fff7ddc8258",
            "parentcaller": "0x7fff7ddc88d7",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:32:03,821",
            "thread_id": "6184",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002290"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b51edf0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:32:03,836",
            "thread_id": "6184",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000226c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b51eb90"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:32:03,836",
            "thread_id": "6204",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002290"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b79d270"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:32:03,836",
            "thread_id": "6204",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff97038db3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:32:03,836",
            "thread_id": "6204",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:32:03,836",
            "thread_id": "5388",
            "caller": "0x7fff96542a0c",
            "parentcaller": "0x7fff82acf12b",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000020f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:32:03,836",
            "thread_id": "5388",
            "caller": "0x7fff96542a0c",
            "parentcaller": "0x7fff82acf12b",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001844"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5388",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5388",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aaa7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001b4c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002208"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020000",
                "pretty_value": "READ_CONTROL"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 1,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5220",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000240c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "4824",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c764ab",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0aa49000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "6272",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5496",
            "caller": "0x7fff7dfe4428",
            "parentcaller": "0x7fff7dfe3a03",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F0AE1542-F497-484B-A175-A20DB09144BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8DC24A1A-6314-4769-9D68-179786F4CED6"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5496",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff945258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5496",
            "caller": "0x7fff94525882",
            "parentcaller": "0x7fff94528f55",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4234D49B-0245-4DF3-B780-3893943456E1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E6-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:32:03,852",
            "thread_id": "5496",
            "caller": "0x7fff82a758e1",
            "parentcaller": "0x7fff82a75ef1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "02C5CCF3-805F-4654-A7B7-340A74335365"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:32:04,086",
            "thread_id": "6204",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:32:04,086",
            "thread_id": "6184",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:32:04,086",
            "thread_id": "6184",
            "caller": "0x7fff81796afa",
            "parentcaller": "0x7fff98cc16e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000404",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:32:04,274",
            "thread_id": "6184",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff98cc16e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002184"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:32:07,508",
            "thread_id": "5196",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff984bf034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00002288"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002184"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:32:07,508",
            "thread_id": "5196",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002184"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0755f550"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "6168",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "6168",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000269c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x011fd710"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "6168",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff97038db3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "41FD88F7-F295-4D39-91AC-A85F3149A05B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "6184",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c232",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002580"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0b51eb90"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "6184",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CCC63AE1-56A5-4F9C-ABE8-E55674F0C0A6"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DA620430-5F6C-447D-8091-C5757E275B37"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "4840",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0fc42000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff984d319a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7BCE3CFB-954C-438F-974C-73A8E0593F1A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "4840",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff9706aff0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000352-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:32:07,618",
            "thread_id": "4840",
            "caller": "0x7fff9443083e",
            "parentcaller": "0x7fff9443072b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "317D06E8-5F24-433D-BDF7-79CE68D8ABC2"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "EC5EC8A9-C395-4314-9C77-54D7A935FF70"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:32:07,633",
            "thread_id": "6184",
            "caller": "0x7fff98b64db6",
            "parentcaller": "0x7fff98b63b55",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000024a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\twinui.pcshell.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:32:07,633",
            "thread_id": "6184",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff818a22b4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 1,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:32:07,664",
            "thread_id": "6184",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c7db07",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x0a323000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:32:08,789",
            "thread_id": "6184",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:32:10,539",
            "thread_id": "5160",
            "caller": "0x7ff6639c652c",
            "parentcaller": "0x7ff6639c5d54",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 14,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:32:10,539",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002200"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:32:10,539",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000026a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x13b40000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000eb000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:32:10,539",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x13b40000"
              },
              {
                "name": "RegionSize",
                "value": "0x000eb000"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:32:14,039",
            "thread_id": "5220",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002184"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:32:19,555",
            "thread_id": "5268",
            "caller": "0x7fff9701f303",
            "parentcaller": "0x7fff9701e7f3",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 6,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:32:22,633",
            "thread_id": "5400",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:32:22,649",
            "thread_id": "5196",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff984bf034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000fe4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000024e0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:32:22,649",
            "thread_id": "5196",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000024e0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0755f610"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:32:22,649",
            "thread_id": "5196",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff984bf034",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000fe4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000fe4"
              },
              {
                "name": "Options",
                "value": "0x00000003"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:32:22,649",
            "thread_id": "6272",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:32:22,649",
            "thread_id": "4824",
            "caller": "0x7fff7dfe4428",
            "parentcaller": "0x7fff7dfe3a03",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F0AE1542-F497-484B-A175-A20DB09144BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8DC24A1A-6314-4769-9D68-179786F4CED6"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:32:22,649",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:32:23,883",
            "thread_id": "5400",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff98cc16e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000b94"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:32:40,993",
            "thread_id": "5160",
            "caller": "0x7ff6639c652c",
            "parentcaller": "0x7ff6639c5d54",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 14,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:32:40,993",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002134"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:32:40,993",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001eb0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09020000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000eb000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:32:40,993",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09020000"
              },
              {
                "name": "RegionSize",
                "value": "0x000eb000"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:32:43,539",
            "thread_id": "4900",
            "caller": "0x7fff7be292fb",
            "parentcaller": "0x7fff98cc61f9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:32:44,071",
            "thread_id": "4900",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff974ef22b",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00002078"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:32:44,071",
            "thread_id": "4900",
            "caller": "0x7fff98c5ed8a",
            "parentcaller": "0x7fff98c764ab",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x08ef8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:32:48,680",
            "thread_id": "5300",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff984c5341",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000049c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x0a326420"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "1960"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:32:48,680",
            "thread_id": "5300",
            "caller": "0x7fff9654f430",
            "parentcaller": "0x7fff984c5379",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000049c"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "1960"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:32:48,680",
            "thread_id": "1960",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000049c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:32:48,680",
            "thread_id": "1960",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000468"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5388",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001d48"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5388",
            "caller": "0x7fff964ffcb5",
            "parentcaller": "0x7fff96545984",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001d48"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4824",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4900",
            "caller": "0x7ff6639e9d10",
            "parentcaller": "0x7ff6639e9c74",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4900",
            "caller": "0x7ff6639e9d60",
            "parentcaller": "0x7ff6639e9c74",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff7f36d59f",
            "parentcaller": "0x7fff7f3ac80c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000025ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff7f36d62c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000022cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff984c5341",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000021f4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x0a325000"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "4704"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff9654f430",
            "parentcaller": "0x7fff984c5379",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000021f4"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "4704"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff984c5341",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00002188",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x0a3257e0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "6212"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff9654f430",
            "parentcaller": "0x7fff984c5379",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00002188"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "6212"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "6272",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a1dfa",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000344-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4704",
            "caller": "0x7fff7dfe4428",
            "parentcaller": "0x7fff7dfe3a03",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F0AE1542-F497-484B-A175-A20DB09144BA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8DC24A1A-6314-4769-9D68-179786F4CED6"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff984c5341",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00001f30",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x0a325e00"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "6216"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "5300",
            "caller": "0x7fff9654f430",
            "parentcaller": "0x7fff984c5379",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00001f30"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "6216"
              },
              {
                "name": "ProcessId",
                "value": "4676"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "6272",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff944c9e99",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x4574f454d"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4704",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff945258d4",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4704",
            "caller": "0x7fff94525882",
            "parentcaller": "0x7fff94528f55",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4234D49B-0245-4DF3-B780-3893943456E1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000401",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "000214E6-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4704",
            "caller": "0x7fff82a758e1",
            "parentcaller": "0x7fff82a75ef1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "02C5CCF3-805F-4654-A7B7-340A74335365"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:32:48,696",
            "thread_id": "4704",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001848"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:32:48,868",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:32:48,868",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:32:48,883",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:32:48,883",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:32:48,899",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:32:48,899",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:32:48,914",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:32:48,914",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:32:48,930",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:32:48,930",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:32:48,946",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:32:48,946",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:32:48,961",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:32:48,961",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:32:48,977",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:32:48,977",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:32:48,993",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:32:48,993",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:32:49,024",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:32:49,024",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:32:49,039",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:32:49,039",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:32:49,055",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:32:49,055",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:32:49,071",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:32:49,071",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:32:49,086",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:32:49,086",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:32:49,102",
            "thread_id": "5160",
            "caller": "0x7ff6639ea06e",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "660B90C8-73A9-4B58-8CAE-355B7F55341B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "DE25675A-72DE-44B4-9373-05170450C140"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:32:49,102",
            "thread_id": "5160",
            "caller": "0x7ff6639ea0c1",
            "parentcaller": "0x7ff6639d6f8c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:32:53,477",
            "thread_id": "5456",
            "caller": "0x7fff97446aa3",
            "parentcaller": "0x7fff98cb2dc9",
            "category": "threading",
            "api": "NtQueueApcThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "4676"
              },
              {
                "name": "ThreadId",
                "value": "5280"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a60"
              },
              {
                "name": "ApcRoutine",
                "value": "0x7fff9744ded0"
              },
              {
                "name": "Module",
                "value": "sechost.dll"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:32:53,680",
            "thread_id": "5456",
            "caller": "0x7fff7f36e842",
            "parentcaller": "0x7fff98cc16e9",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000214c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\Bam"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:32:53,774",
            "thread_id": "5160",
            "caller": "0x7ff6639c652c",
            "parentcaller": "0x7ff6639c5d54",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 14,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:32:53,789",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000850"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:32:53,789",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000021e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09470000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000eb000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:32:53,789",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09470000"
              },
              {
                "name": "RegionSize",
                "value": "0x000eb000"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:32:53,789",
            "thread_id": "5160",
            "caller": "0x7ff6639c652c",
            "parentcaller": "0x7ff6639c5d54",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 14,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:32:53,789",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002618"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\SecurityHealthSSO.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:32:53,789",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09470000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000eb000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:32:53,789",
            "thread_id": "5160",
            "caller": "0x7ff6639d23a8",
            "parentcaller": "0x7ff6639d2e19",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x09470000"
              },
              {
                "name": "RegionSize",
                "value": "0x000eb000"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:32:54,586",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wscinterop"
              },
              {
                "name": "DllBase",
                "value": "0x7fff38ee0000"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:32:54,586",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscinterop.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff38ee0000"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:32:54,586",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WSCAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff869c0000"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:32:54,586",
            "thread_id": "5564",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000226c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff7a4166f1",
            "parentcaller": "0x7fff7a4124f4",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9DAC2C1E-7C5C-40EB-833B-323E85A1CE84"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "418EE892-56F0-4C3B-9238-696BA0CEF799"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002614"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff96507906",
            "parentcaller": "0x7fff96505630",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000ec8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03310000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00015000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff98c9bb2a",
            "parentcaller": "0x7fff98c9b99e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000ec8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\wscui.cpl.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff98c9bbcc",
            "parentcaller": "0x7fff98c9b99e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00002614"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x03330000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0bf1d220"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00002614"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000ec4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff38ec0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff98b64db6",
            "parentcaller": "0x7fff98b63b55",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000ebc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff98b64db6",
            "parentcaller": "0x7fff98b63b55",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wscui.cpl"
              },
              {
                "name": "DllBase",
                "value": "0x7fff38ec0000"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\framedynos"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a6d0000"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wer"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94030000"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\werconcpl"
              },
              {
                "name": "DllBase",
                "value": "0x7fff38de0000"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:32:54,602",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\werconcpl.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff38de0000"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:32:54,618",
            "thread_id": "6252",
            "caller": "0x7fff7a4166f1",
            "parentcaller": "0x7fff7a4124f4",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CA236752-2E77-4386-B63B-0E34774A413D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "418EE892-56F0-4C3B-9238-696BA0CEF799"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:32:54,633",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\hcproviders"
              },
              {
                "name": "DllBase",
                "value": "0x7fff38dc0000"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:32:54,633",
            "thread_id": "6252",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hcproviders.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff38dc0000"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:32:54,633",
            "thread_id": "6252",
            "caller": "0x7fff7a4166f1",
            "parentcaller": "0x7fff7a4124f4",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C8E6F269-B90A-4053-A3BE-499AFCEC98C4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "418EE892-56F0-4C3B-9238-696BA0CEF799"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:32:54,633",
            "thread_id": "6252",
            "caller": "0x7fff98c9bb2a",
            "parentcaller": "0x7fff98c9b99e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000cc4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\Actioncenter.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:32:54,633",
            "thread_id": "6252",
            "caller": "0x7fff98c9bbcc",
            "parentcaller": "0x7fff98c9b99e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000cd8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x07c60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x0bf1c3f0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:32:54,633",
            "thread_id": "6244",
            "caller": "0x7fff7a782263",
            "parentcaller": "0x7fff7a78300b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "900C0763-5CAD-4A34-BC1F-40CD513679D5"
              },
              {
                "name": "ClsContext",
                "value": "0x00000003",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER"
              },
              {
                "name": "riid",
                "value": "8E282AAE-ACE9-4821-83AD-849C1D08939D"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:32:54,633",
            "thread_id": "6244",
            "caller": "0x7fff38dc1625",
            "parentcaller": "0x7fff7a7822b1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:32:54,649",
            "thread_id": "6244",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ieproxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff38cd0000"
              }
            ],
            "repeated": 0,
            "id": 737
          }
        ],
        "threads": [
          "6208",
          "5300",
          "5468",
          "4824",
          "4900",
          "5160",
          "5220",
          "8044",
          "6168",
          "5456",
          "4840",
          "5700",
          "5460",
          "5496",
          "8336",
          "5388",
          "6272",
          "5216",
          "6204",
          "6200",
          "6196",
          "6184",
          "5196",
          "5268",
          "5400",
          "1960",
          "4704",
          "6252",
          "5564",
          "6244"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff663980000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 840,
        "process_name": "svchost.exe",
        "parent_id": 672,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "first_seen": "2026-05-28 22:31:57,290",
        "calls": [
          {
            "timestamp": "2026-05-28 22:31:59,353",
            "thread_id": "940",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 3,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:32:00,087",
            "thread_id": "936",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000fe4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:32:00,087",
            "thread_id": "936",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000664"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21f29b40000"
              },
              {
                "name": "SectionOffset",
                "value": "0xb0f52fe170"
              },
              {
                "name": "ViewSize",
                "value": "0x0007a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:32:00,087",
            "thread_id": "936",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff965289f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000664"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000fd4"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140733193397452"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:32:00,603",
            "thread_id": "936",
            "caller": "0x7fff965289f3",
            "parentcaller": "0x7fff98b6de30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000010",
                "pretty_value": "CREATE_NEW_CONSOLE"
              },
              {
                "name": "ProcessId",
                "value": "9420"
              },
              {
                "name": "ThreadId",
                "value": "1716"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000664"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000fd4"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "4308",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00001550"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "4308",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000015a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21f29b40000"
              },
              {
                "name": "SectionOffset",
                "value": "0xb0f5e7df60"
              },
              {
                "name": "ViewSize",
                "value": "0x0007a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "4308",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff965289f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000015a4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014ac"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140733193398608"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:32:00,978",
            "thread_id": "4308",
            "caller": "0x7fff965289f3",
            "parentcaller": "0x7fff98b6de30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000010",
                "pretty_value": "CREATE_NEW_CONSOLE"
              },
              {
                "name": "ProcessId",
                "value": "10576"
              },
              {
                "name": "ThreadId",
                "value": "10580"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000015a4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000014ac"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:32:02,447",
            "thread_id": "936",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:32:02,572",
            "thread_id": "940",
            "caller": "0x7fff964facfe",
            "parentcaller": "0x7fff97459f03",
            "category": "services",
            "api": "StartServiceW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ServiceHandle",
                "value": "0x21f29968d80"
              },
              {
                "name": "ServiceName",
                "value": "MicrosoftEdgeElevationService"
              },
              {
                "name": "Arguments",
                "value": []
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:32:04,119",
            "thread_id": "1452",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000fa0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:32:07,822",
            "thread_id": "1452",
            "caller": "0x7fff9414999a",
            "parentcaller": "0x7fff9414975c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000014ec"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015f4"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:32:07,853",
            "thread_id": "4308",
            "caller": "0x7fff94237f97",
            "parentcaller": "0x7fff9423b4bb",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000fe4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000014c4"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:32:07,853",
            "thread_id": "4308",
            "caller": "0x7fff94232c08",
            "parentcaller": "0x7fff9424266e",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001550"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0x00001238"
              },
              {
                "name": "TargetHandle",
                "value": "0x000009dc"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:32:07,853",
            "thread_id": "4308",
            "caller": "0x7fff94232c42",
            "parentcaller": "0x7fff9424266e",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001600"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0x00001238"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000470"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:32:07,853",
            "thread_id": "4308",
            "caller": "0x7fff94232c77",
            "parentcaller": "0x7fff9424266e",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001604"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0x00001238"
              },
              {
                "name": "TargetHandle",
                "value": "0x000009e4"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:32:12,447",
            "thread_id": "4308",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000015f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:32:32,462",
            "thread_id": "4308",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000153c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:32:42,462",
            "thread_id": "1060",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000159c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:32:52,447",
            "thread_id": "940",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:32:52,947",
            "thread_id": "940",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff942d1c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000e88"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015fc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:32:52,947",
            "thread_id": "940",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff965289f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000d3c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x0000160c"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\system32\\DllHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140733193391736"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:32:52,994",
            "thread_id": "940",
            "caller": "0x7fff965289f3",
            "parentcaller": "0x7fff98b6de30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Windows\\system32\\DllHost.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000410",
                "pretty_value": "CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT"
              },
              {
                "name": "ProcessId",
                "value": "3704"
              },
              {
                "name": "ThreadId",
                "value": "3808"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000d3c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x0000160c"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:32:53,009",
            "thread_id": "4308",
            "caller": "0x7fff942422bd",
            "parentcaller": "0x7fff9414ce49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000015f0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000104c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:32:53,119",
            "thread_id": "4308",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff942d1c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000e88"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000015f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:32:53,181",
            "thread_id": "4308",
            "caller": "0x7fff942422bd",
            "parentcaller": "0x7fff9414ce49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001404"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000c50"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:32:53,337",
            "thread_id": "4308",
            "caller": "0x7fff942422bd",
            "parentcaller": "0x7fff9414ce49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001614"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001618"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:32:53,603",
            "thread_id": "940",
            "caller": "0x7fff942422bd",
            "parentcaller": "0x7fff9414ce49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000158c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000698"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:32:53,650",
            "thread_id": "4308",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000014a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\mousocoreworker.exe"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:32:53,650",
            "thread_id": "4308",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001460"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x21f2b300000"
              },
              {
                "name": "SectionOffset",
                "value": "0xb0f5e7df60"
              },
              {
                "name": "ViewSize",
                "value": "0x001a9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:32:53,650",
            "thread_id": "4308",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff965289f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001460"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001510"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Windows\\System32\\mousocoreworker.exe"
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\System32\\mousocoreworker.exe -Embedding"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "140733193396064"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:32:53,681",
            "thread_id": "4308",
            "caller": "0x7fff965289f3",
            "parentcaller": "0x7fff98b6de30",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\System32\\mousocoreworker.exe -Embedding"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000010",
                "pretty_value": "CREATE_NEW_CONSOLE"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "ThreadId",
                "value": "4572"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00001460"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001510"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:32:59,587",
            "thread_id": "940",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff942d1c70",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000e88"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00001558"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:33:01,087",
            "thread_id": "936",
            "caller": "0x7fff942422bd",
            "parentcaller": "0x7fff9414ce49",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006e8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000153c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 34
          }
        ],
        "threads": [
          "940",
          "936",
          "4308",
          "1452",
          "1060"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff71f590000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 7284,
        "process_name": "msedge.exe",
        "parent_id": 4676,
        "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
        "first_seen": "2026-05-28 22:31:59,102",
        "calls": [
          {
            "timestamp": "2026-05-28 22:31:59,164",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:31:59,164",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\version"
              },
              {
                "name": "DllBase",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:31:59,164",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:31:59,164",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:31:59,164",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\Wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:31:59,180",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.storage"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94410000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:31:59,180",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SHCORE"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:31:59,180",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95450000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:31:59,321",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINMM"
              },
              {
                "name": "DllBase",
                "value": "0x7fff84a60000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:31:59,321",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3ee40000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:31:59,321",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\KBDUS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff833e0000"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:31:59,321",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\KBDUS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff833e0000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:31:59,321",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5236",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff965289f3",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000378"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000374"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x348,0x35c,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "5600"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "5236",
            "caller": "0x7fff965289f3",
            "parentcaller": "0x7fff983d7d70",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x348,0x35c,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080000",
                "pretty_value": "EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "5600"
              },
              {
                "name": "ThreadId",
                "value": "5544"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000378"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000374"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d840000"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\gpapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94bc0000"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wkscli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95490000"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:31:59,336",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95850000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MDMRegistration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fd70000"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95d10000"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82660000"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\omadmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82e70000"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:31:59,352",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95cd0000"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MDMRegistration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fd70000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\omadmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82e70000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DMCmnUtils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82660000"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95d10000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95cd0000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSREG"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92030000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96260000"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSREG"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92030000"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:31:59,368",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\AssignedAccessRuntime"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d820000"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x7fff97f00000"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SystemSettings.DataModel"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8cef0000"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:31:59,399",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DWrite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a140000"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4568",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8f850000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff960b0000"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\IPHLPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff956f0000"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\NLAapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91940000"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\NSI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98020000"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "4556",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CFGMGR32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96af0000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "5452",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\StructuredQuery"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8beb0000"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc6"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8ead0000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dhcpcsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8eab0000"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:31:59,414",
            "thread_id": "5452",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91eb0000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DNSAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95730000"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "1668",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b820000"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93840000"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92180000"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93160000"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a6e0000"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "5452",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Windows.Storage.Search"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b750000"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\twinapi.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90da0000"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\twinapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82bc0000"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "1668",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\mssprxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a550000"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:31:59,430",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff905b0000"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "4568",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\edputil"
              },
              {
                "name": "DllBase",
                "value": "0x7fff86740000"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WindowManagementAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90fb0000"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\InputHost"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a580000"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a7e0000"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "5796",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WTSAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91fe0000"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "8008",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ColorAdapterClient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90620000"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "8008",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\mscms"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90660000"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\iertutil"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c3b0000"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Web"
              },
              {
                "name": "DllBase",
                "value": "0x7fff865d0000"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:31:59,446",
            "thread_id": "5796",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINSTA"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ff0000"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:31:59,461",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINHTTP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90780000"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:31:59,477",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3d4e0000"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:31:59,493",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.UI.Immersive"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a3c0000"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:31:59,493",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\Secur32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff87320000"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:31:59,493",
            "thread_id": "6904",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000a34"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a30"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2464,i,6363073462286893154,122142860457183492,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2556 /prefetch:3"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "8728"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:31:59,493",
            "thread_id": "6904",
            "caller": "0x7fff96529666",
            "parentcaller": "0x7fff98b6cec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2464,i,6363073462286893154,122142860457183492,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2556 /prefetch:3"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080000",
                "pretty_value": "EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8728"
              },
              {
                "name": "ThreadId",
                "value": "1604"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000a34"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000a30"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2744",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000af4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000af0"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,11285122921339835690,13411714936228308146,262144 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2324 /prefetch:2"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "9256"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "7980",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000b24"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000b10"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2620,i,16624453374801861901,2017422552223441830,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "9276"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "6344",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\LINKINFO"
              },
              {
                "name": "DllBase",
                "value": "0x7fff853f0000"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2744",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,11285122921339835690,13411714936228308146,262144 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2324 /prefetch:2"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "9256"
              },
              {
                "name": "ThreadId",
                "value": "9260"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000af4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000af0"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "7980",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2620,i,16624453374801861901,2017422552223441830,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "9276"
              },
              {
                "name": "ThreadId",
                "value": "9280"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000b24"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000b10"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dxgi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94bf0000"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\d3d11"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92740000"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dcomp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff929b0000"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dataexchange"
              },
              {
                "name": "DllBase",
                "value": "0x7fff80590000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.Profile.RetailInfo"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d6a0000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2744",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000e8c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000e88"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72010649 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3524,i,12540446788744744878,2483364207054016915,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3532 /prefetch:1"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "9620"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\OLEACC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff80840000"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "8048",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000ea4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000ea0"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72015610 --skip-read-main-dll --metrics-shmem-handle=3612,i,2898914090110436564,14889825992066690183,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3664 /prefetch:1"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "9648"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\directmanipulation"
              },
              {
                "name": "DllBase",
                "value": "0x7fff877f0000"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2744",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72010649 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3524,i,12540446788744744878,2483364207054016915,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3532 /prefetch:1"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "9620"
              },
              {
                "name": "ThreadId",
                "value": "9624"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000e8c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000e88"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "8048",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72015610 --skip-read-main-dll --metrics-shmem-handle=3612,i,2898914090110436564,14889825992066690183,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3664 /prefetch:1"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "9648"
              },
              {
                "name": "ThreadId",
                "value": "9652"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00000ea4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000ea0"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\dwmapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93e40000"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:31:59,868",
            "thread_id": "9928",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core"
              },
              {
                "name": "DllBase",
                "value": "0x7fff84f00000"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:31:59,868",
            "thread_id": "8008",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d100000"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:31:59,899",
            "thread_id": "4556",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff874d0000"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:31:59,899",
            "thread_id": "2744",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\MSASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95e30000"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:31:59,899",
            "thread_id": "1668",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\vaultcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff78140000"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:31:59,899",
            "thread_id": "2744",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\CRYPTSP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:31:59,899",
            "thread_id": "2744",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\rsaenh"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:31:59,946",
            "thread_id": "1668",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MicrosoftAccountWAMExtension"
              },
              {
                "name": "DllBase",
                "value": "0x7fff59130000"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "2140",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:32:02,571",
            "thread_id": "2040",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\sxs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff960c0000"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:32:02,586",
            "thread_id": "2040",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\usermgrcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff916b0000"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:32:02,586",
            "thread_id": "2040",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7ddc0000"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:32:03,821",
            "thread_id": "9952",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ShellCommonCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7cee0000"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:32:06,336",
            "thread_id": "2140",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001508"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001504"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5320,i,17754333930940707777,4047379628757978089,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5324 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "11572"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:32:06,336",
            "thread_id": "2140",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5320,i,17754333930940707777,4047379628757978089,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5324 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "11572"
              },
              {
                "name": "ThreadId",
                "value": "11576"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00001508"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001504"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:32:07,493",
            "thread_id": "7968",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000015cc"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015a4"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5560,i,10756999430082579342,5291797573898009904,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5576 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "11652"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:32:07,493",
            "thread_id": "7968",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5560,i,10756999430082579342,5291797573898009904,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5576 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "11652"
              },
              {
                "name": "ThreadId",
                "value": "11656"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000015cc"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000015a4"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:32:07,524",
            "thread_id": "9588",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a280000"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:32:07,555",
            "thread_id": "9588",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds"
              },
              {
                "name": "DllBase",
                "value": "0x7fff39c20000"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:32:07,555",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\netprofm"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91760000"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:32:07,555",
            "thread_id": "8008",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\SETUPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff986e0000"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:32:07,555",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3d070000"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:32:07,555",
            "thread_id": "8008",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:32:07,555",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\npmproxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e350000"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:32:07,555",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\TenantRestrictionsPlugin"
              },
              {
                "name": "DllBase",
                "value": "0x7fff83180000"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:32:07,571",
            "thread_id": "3880",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WINTRUST"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96a80000"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:32:07,571",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\FirewallAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94f50000"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:32:07,571",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\fwbase"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94f10000"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:32:07,571",
            "thread_id": "11744",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001754"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00001750"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "11752"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:32:07,571",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration"
              },
              {
                "name": "DllBase",
                "value": "0x7fff39ba0000"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:32:07,586",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\RMCLIENT"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94110000"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:32:07,586",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91e70000"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:32:07,586",
            "thread_id": "1676",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wpnapps"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82770000"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:32:07,743",
            "thread_id": "11744",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\capauthz"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e6a0000"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:32:07,743",
            "thread_id": "11744",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.staterepositorycore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b370000"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:32:07,743",
            "thread_id": "11744",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000016d4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000000c8"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application;"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:32:07,977",
            "thread_id": "11744",
            "caller": "0x7fff96529666",
            "parentcaller": "0x7fff98b6cec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080400",
                "pretty_value": "CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x000016d4"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000000c8"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:32:08,008",
            "thread_id": "3880",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.ApplicationModel"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85060000"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:32:08,008",
            "thread_id": "3880",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\AppXDeploymentClient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8ed20000"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:32:08,008",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wlanapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e370000"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:32:08,008",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wlanapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e370000"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:32:08,071",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:32:08,086",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ncrypt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95d10000"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:32:08,086",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NTASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95cd0000"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:32:08,086",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\PCPKsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e580000"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:32:08,102",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:32:08,102",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:32:08,102",
            "thread_id": "3176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\ncryptprov"
              },
              {
                "name": "DllBase",
                "value": "0x7fff834f0000"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:32:08,289",
            "thread_id": "4876",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\mswsock"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95a00000"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:32:29,336",
            "thread_id": "2388",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82e60000"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:32:29,477",
            "thread_id": "6904",
            "caller": "0x7fff9652c5f2",
            "parentcaller": "0x7fff96529666",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x0000058c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000588"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,7756914649097871830,5918365439921352,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=1412 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "8148"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:32:29,477",
            "thread_id": "6904",
            "caller": "0x7fff96529666",
            "parentcaller": "0x7fff98b6cec4",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": ""
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,7756914649097871830,5918365439921352,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=1412 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x00080000",
                "pretty_value": "EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "8148"
              },
              {
                "name": "ThreadId",
                "value": "8068"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x0000058c"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000588"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:32:59,461",
            "thread_id": "2140",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\sppc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94e40000"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:32:59,461",
            "thread_id": "2140",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\slc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94e70000"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:32:59,461",
            "thread_id": "2140",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\slwga"
              },
              {
                "name": "DllBase",
                "value": "0x7fff391c0000"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:32:59,477",
            "thread_id": "9588",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff391a0000"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:32:59,555",
            "thread_id": "2140",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "NtCreateUserProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00001628"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000016c4"
              },
              {
                "name": "ProcessDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ThreadDesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "ProcessFileName",
                "value": ""
              },
              {
                "name": "ThreadName",
                "value": ""
              },
              {
                "name": "ImagePathName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5700,i,1918180883024487797,9552434258275741559,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6332 /prefetch:8"
              },
              {
                "name": "DllPath",
                "value": ""
              },
              {
                "name": "ProcessId",
                "value": "13228"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:32:59,555",
            "thread_id": "2140",
            "caller": "0x7ff6f9527d66",
            "parentcaller": "0x7ff6f95281c2",
            "category": "process",
            "api": "CreateProcessInternalW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ApplicationName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe"
              },
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5700,i,1918180883024487797,9552434258275741559,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6332 /prefetch:8"
              },
              {
                "name": "CreationFlags",
                "value": "0x0008040c",
                "pretty_value": "CREATE_SUSPENDED|DETACHED_PROCESS|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT"
              },
              {
                "name": "ProcessId",
                "value": "13228"
              },
              {
                "name": "ThreadId",
                "value": "13232"
              },
              {
                "name": "ParentHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ProcessHandle",
                "value": "0x00001628"
              },
              {
                "name": "ThreadHandle",
                "value": "0x000016c4"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:32:59,696",
            "thread_id": "7496",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CloudExperienceHostCommon"
              },
              {
                "name": "DllBase",
                "value": "0x7fff39030000"
              }
            ],
            "repeated": 0,
            "id": 179
          }
        ],
        "threads": [
          "7496",
          "5236",
          "2140",
          "4568",
          "4556",
          "5452",
          "1668",
          "5796",
          "8008",
          "6904",
          "2744",
          "7980",
          "6344",
          "8048",
          "9928",
          "2040",
          "9952",
          "7968",
          "9588",
          "1676",
          "3176",
          "3880",
          "11744",
          "4876",
          "2388"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://sugarcraft.net/\"",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff6f9430000",
          "MainExeSize": "0x00505000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 8372,
        "process_name": "msinfo32.exe",
        "parent_id": 4676,
        "module_path": "C:\\Windows\\System32\\msinfo32.exe",
        "first_seen": "2026-05-28 22:31:59,112",
        "calls": [
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98030000"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98030000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055bf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c9cb1e",
            "parentcaller": "0x7fff96523958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c9cb70",
            "parentcaller": "0x7fff96523958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "1646"
              },
              {
                "name": "y",
                "value": "290"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff7d359253",
            "parentcaller": "0x7fff7d35d8bd",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06f20bb0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff7d350000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#3585"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff964fe6a1",
            "parentcaller": "0x7fff7d351666",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\MFC42LOC.DLL"
              },
              {
                "name": "dwFlags",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff964fe6a1",
            "parentcaller": "0x7fff7d351666",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\mfc42u"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d350000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff7d36f760"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\atl"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92000000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff92001d50"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b642c4",
            "parentcaller": "0x7fff98b63b55",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000218"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b64459",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000248"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004",
                "pretty_value": "SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000218"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b644a6",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000248"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f30000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff98b75ec5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xd4\\xcd@\\x9d\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xc8\\xc1\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xd5\\xcd@\\x9d\\x00\\x00\\x00\\xb8\\xc1\\x15S\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xc1\\x15S\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b5e7a0",
            "parentcaller": "0x7fff98b65084",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000024c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b5e7f0",
            "parentcaller": "0x7fff98b65084",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000024c"
              },
              {
                "name": "ValueName",
                "value": "PreferExternalManifest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b5e818",
            "parentcaller": "0x7fff98b65084",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b76103",
            "parentcaller": "0x7fff98b651de",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000218"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b64f83",
            "parentcaller": "0x7fff98b6468c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b64f8a",
            "parentcaller": "0x7fff98b6468c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b6468c",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b62a0e",
            "parentcaller": "0x7fff82f33a53",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "ThemePropScrollBarCtl"
              },
              {
                "name": "Atom",
                "value": "0x0000c01b"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98b62a0e",
            "parentcaller": "0x7fff82f33a6d",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MicrosoftTabletPenServiceProperty"
              },
              {
                "name": "Atom",
                "value": "0x0000c01c"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff82f33bac",
            "parentcaller": "0x7fff82f33add",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001022"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff82f33aeb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "LPK"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff82f33b03",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "GDI32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98480000"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff82f33b1e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98480000"
              },
              {
                "name": "FunctionName",
                "value": "LpkEditControl"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff984a5740"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff82f33b1e",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\comctl32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff82f69e70"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff982e49b0",
            "parentcaller": "0x7fff98315a51",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\comdlg32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982e0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff98313a50"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98d0e53f",
            "parentcaller": "0x7fff98c6faf7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "UMPDC.dll"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\umpdc.dll"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000024c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\umpdc.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98cafcfe",
            "parentcaller": "0x7fff98caf7b0",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000250"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000024c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\umpdc.dll"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000250"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96170000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c5fee4",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96180000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c5ffb5",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c65082",
            "parentcaller": "0x7fff98c679d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98cafd68",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\umpdc"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96170000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96173e30"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff961b0000"
              },
              {
                "name": "ModuleName",
                "value": "POWRPROF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff961b0000"
              },
              {
                "name": "ModuleName",
                "value": "POWRPROF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\powrprof"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96190000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96193480"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff96524f76",
            "parentcaller": "0x7fff94e445b3",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e445d6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92e80"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e445ef",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0390"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e44608",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d10"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e44621",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c9f1b0"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff964fba2b",
            "parentcaller": "0x7fff94e4a61b",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\sppc"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94e40000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94e43920"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff96524f76",
            "parentcaller": "0x7fff94e7166e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e71697",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92e80"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:31:59,174",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716b6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0390"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716d5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d10"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716f4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c9f1b0"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716f4",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\slc"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94e70000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94e71bd0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff726af1440"
              },
              {
                "name": "Parameter",
                "value": "0x9d40f7a000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8844",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c677c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 2,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "1164",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "1164",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71a00"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8844",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8844",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71ed0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8840",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8840",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f72030"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8964",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055c2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8964",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "8964",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71e10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af1a71",
            "parentcaller": "0x7ff726af1298",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff726af1a20"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af11be",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f87000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af11be",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f88000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726ad4821",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f89000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726ad55c5",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f8a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726ad57be",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06e81000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0896",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f30000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0896",
            "parentcaller": "0x7ff726af1399",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000026c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000026c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9421f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94213f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055c4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff93cf0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\uxtheme.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "uxtheme.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff93cf0000"
              },
              {
                "name": "FunctionName",
                "value": "ThemeInitApiHook"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff93cfcde0"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xe7\\xcd@\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000274"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000274"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000274"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "AppsUseLightTheme"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000280"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000280"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000280"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000280"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:31:59,190",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055cd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x00000280"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000280"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xed\\xcd@\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xf0\\xed\\xcd@\\x9d\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000286"
              },
              {
                "name": "SubKey",
                "value": "AppID\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64GetCurrentMachine"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d90"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64IsWowGuestMachineSupported"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccc670"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000286"
              },
              {
                "name": "SubKey",
                "value": "AppID\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xf2\\xcd@\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6CP\\x96\\xff\\x7f\\x00\\x00\\x92A\\xe2\\x96\\x8d\\xbe\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af0649",
            "parentcaller": "0x7ff726af094c",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x1de0559223a",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af065d",
            "parentcaller": "0x7ff726af094c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d37000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af065d",
            "parentcaller": "0x7ff726af094c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d37000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af065d",
            "parentcaller": "0x7ff726af094c",
            "category": "misc",
            "api": "CommandLineToArgvW",
            "status": true,
            "return": "0x1de055acfa0",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              },
              {
                "name": "NumArgs",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af0476",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70cf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#9"
              },
              {
                "name": "Name",
                "value": "#213"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af0476",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de06e77498",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de06e70cf0"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70aa0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#5"
              },
              {
                "name": "Name",
                "value": "#400"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de06e714a0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de06e70aa0"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055d1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000028c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000028c"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000028c"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000028c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000028c"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000028c"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000028c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "MSCTF.dll"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000028c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00114000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdb000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000028c"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdb000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x7fff97f00000"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msctf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff97f40760"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\ThemeSection"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000298"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d40cde000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Windows\\Theme770907464"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000029c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\Theme928852983"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f60000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000294"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d40cde720"
              },
              {
                "name": "ViewSize",
                "value": "0x000e2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000029c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de06f60000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d40cde720"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8372:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06f707d0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#4"
              },
              {
                "name": "Name",
                "value": "#16"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de06f71190",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de06f707d0"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089d2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a4"
              },
              {
                "name": "ValueName",
                "value": "ResourcePolicies"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08960000"
              },
              {
                "name": "RegionSize",
                "value": "0x00032000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08960000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089d4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 3,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xe8\\xcd@\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00`\\xc2\\xd6\\x97\\xff\\x7f\\x00\\x00\\x83\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8a\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\xc4\\x1e\\x93\\x96\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a4"
              },
              {
                "name": "SubKey",
                "value": "Control Panel\\Desktop"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "SmoothScroll"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a4"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "EnableBalloonTips"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "ListviewAlphaSelect"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "ListviewShadow"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "AccListViewV6"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "UseDoubleClickTimer"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:31:59,205",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f55670"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000a8"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b5a190"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b70170"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de092c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d40cdd970"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055db000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              },
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b0"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "67"
              },
              {
                "name": "MaxValueNameLength",
                "value": "27"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055de000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "Lucida Sans Unicode"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lucida Sans Unicode"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "Microsoft Sans Serif"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft Sans Serif"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "Tahoma"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Tahoma"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Bold"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Light"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Semibold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Semibold"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "Ebrima"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Ebrima"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "Ebrima Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Ebrima Bold"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "Gadugi"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gadugi"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "Gadugi Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gadugi Bold"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "Khmer UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Khmer UI"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "ValueName",
                "value": "Khmer UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Khmer UI Bold"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "ValueName",
                "value": "Lao UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lao UI"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "ValueName",
                "value": "Lao UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lao UI Bold"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee Bold"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee UI"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee UI Bold"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI Bold"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "ValueName",
                "value": "MingLiU"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "ValueName",
                "value": "PMingLiU"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\PMingLiU"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "ValueName",
                "value": "MingLiU_HKSCS"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU_HKSCS"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "ValueName",
                "value": "MingLiU-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU-ExtB"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "ValueName",
                "value": "PMingLiU-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\PMingLiU-ExtB"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:31:59,221",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "ValueName",
                "value": "MingLiU_HKSCS-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU_HKSCS-ExtB"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei Bold"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI Bold"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI Light"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "ValueName",
                "value": "SimSun"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\SimSun"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "ValueName",
                "value": "SimSun-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\SimSun-ExtB"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "ValueName",
                "value": "NSimSun"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\NSimSun"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei Bold"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI Bold"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI Light"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Bold"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Light"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Semibold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Semibold"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "ValueName",
                "value": "Meiryo"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "ValueName",
                "value": "Meiryo Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo Bold"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "ValueName",
                "value": "Meiryo UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo UI"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "ValueName",
                "value": "Meiryo UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo UI Bold"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "ValueName",
                "value": "MS Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS Gothic"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "ValueName",
                "value": "MS PGothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS PGothic"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "ValueName",
                "value": "MS UI Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS UI Gothic"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "ValueName",
                "value": "MS Mincho"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS Mincho"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "ValueName",
                "value": "MS PMincho"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS PMincho"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "ValueName",
                "value": "Batang"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Batang"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "ValueName",
                "value": "BatangChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\BatangChe"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "ValueName",
                "value": "Dotum"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Dotum"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "ValueName",
                "value": "DotumChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\DotumChe"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "ValueName",
                "value": "Gulim"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gulim"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "ValueName",
                "value": "GulimChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\GulimChe"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "ValueName",
                "value": "Gungsuh"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gungsuh"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "ValueName",
                "value": "GungsuhChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\GungsuhChe"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic Bold"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic Semilight"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "0",
                "pretty_value": "REG_NONE"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055e1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              },
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "ValueName",
                "value": "Disable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "ValueName",
                "value": "DataFilePath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "Buffer",
                "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00"
              },
              {
                "name": "Length",
                "value": "60"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002b0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de09600000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d40cdc9b0"
              },
              {
                "name": "ViewSize",
                "value": "0x01260000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00015000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:31:59,237",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8372:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002bc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff87ff0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000ac000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\TextShaping"
              },
              {
                "name": "DllBase",
                "value": "0x7fff87ff0000"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\TextShaping"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff87ff0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8803a790"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96a65000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96a65000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane2"
              },
              {
                "name": "Data",
                "value": "SimSun-ExtB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Plane16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "4"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "13"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "MingLiU"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MingLiU"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MingLiU_HKSCS"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MingLiU_HKSCS"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "PMingLiU"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\PMingLiU"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "SimSun"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002b8"
              },
              {
                "name": "SubKey",
                "value": "Segoe UI"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:31:59,252",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 1,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "UxSubclassInfo"
              },
              {
                "name": "Atom",
                "value": "0x0000c018"
              }
            ],
            "repeated": 1,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:31:59,268",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f55670"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 3,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f55670"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 17,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726ae9bf8",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70a60",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#4"
              },
              {
                "name": "Name",
                "value": "#200"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726ae9bf8",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de06e70e2c",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de06e70a60"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:31:59,283",
            "thread_id": "7460",
            "caller": "0x7ff726ae9c12",
            "parentcaller": "0x7ff726af019f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada291",
            "parentcaller": "0x7ff726ad97b6",
            "category": "synchronization",
            "api": "NtCreateEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              },
              {
                "name": "EventName",
                "value": "MSInfoDone{E6BF6DC3-F637-4FDE-812B-90700248DE8E}"
              },
              {
                "name": "EventType",
                "value": "0"
              },
              {
                "name": "InitialState",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada2fb",
            "parentcaller": "0x7ff726ad97b6",
            "category": "synchronization",
            "api": "NtCreateEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              },
              {
                "name": "EventName",
                "value": "MSInfoStart{E6BF6DC3-F637-4FDE-812B-90700248DE8E}"
              },
              {
                "name": "EventType",
                "value": "0"
              },
              {
                "name": "InitialState",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aec350",
            "parentcaller": "0x7ff726aec19b",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010586"
              },
              {
                "name": "Message",
                "value": "0x00002100"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aec350",
            "parentcaller": "0x7ff726aec19b",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "228"
              },
              {
                "name": "y",
                "value": "526"
              }
            ],
            "repeated": 1,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aec1cf",
            "parentcaller": "0x7ff726aea165",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010586"
              },
              {
                "name": "Message",
                "value": "0x00002100"
              }
            ],
            "repeated": 1,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aec208",
            "parentcaller": "0x7ff726aea165",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089d8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "PreferExternalManifest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll.Config"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de070a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "HIMAGELIST_QueryInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f4fa20"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DrawShadowText"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fccfe0"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DrawSizeBox"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f5f780"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DrawScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f40d20"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "SizeBoxHwnd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f452d0"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_MouseMove"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc21e0"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_Menu"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc1ff0"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "HandleScrollCmd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc1f50"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DetachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82ed2440"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "AttachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f47150"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "CCSetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f42230"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "CCGetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f5bcc0"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "CCEnableScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82ed2830"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "QuerySystemGestureStatus"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc1fb0"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000068"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000006c"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000026"
              },
              {
                "name": "uiParam",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000103e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001042"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000001b"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8372:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8372:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000006"
              },
              {
                "name": "ObjectAttributes",
                "value": "windows_shell_global_counters"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002cc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de070a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d40cdcc90"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "ValueName",
                "value": "TurnOffSPIAnimations"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aed8c2",
            "parentcaller": "0x7ff726aecc3c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70ab0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#7"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726aecc4d",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726aecc4d",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726ada49e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726ada49e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada41a",
            "parentcaller": "0x7ff726ad9c4d",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002d0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff726ada4e0"
              },
              {
                "name": "Parameter",
                "value": "0x1de06f8c9b0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "2864"
              },
              {
                "name": "ProcessId",
                "value": "8372"
              },
              {
                "name": "Module",
                "value": "msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726ada41a",
            "parentcaller": "0x7ff726ad9c4d",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002d0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff726ada4e0"
              },
              {
                "name": "Parameter",
                "value": "0x1de06f8c9b0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "2864"
              },
              {
                "name": "ProcessId",
                "value": "8372"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aee88a",
            "parentcaller": "0x7ff726aec215",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#24"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aea178",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70cf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#9"
              },
              {
                "name": "Name",
                "value": "#213"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "2864",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aea178",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de06e77498",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de06e70cf0"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "2864",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff726ada4e0"
              },
              {
                "name": "Parameter",
                "value": "0x1de06f8c9b0"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "2864",
            "caller": "0x7ff726ad7fe9",
            "parentcaller": "0x7ff726ada590",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "2864",
            "caller": "0x7ff726ad7ffe",
            "parentcaller": "0x7ff726ada590",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b00",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#23"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "2864",
            "caller": "0x7ff726ad8013",
            "parentcaller": "0x7ff726ada590",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x7ff726b11660",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#399"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x7ff726b23c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x7ff726b11660"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x7ff726b11560",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#3"
              },
              {
                "name": "Name",
                "value": "#11"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x7ff726b21d78",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x7ff726b11560"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:31:59,299",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e4"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e4"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49238"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49239"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e4"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 1,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.Asm.MutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "Milliseconds",
                "value": "2000"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Local\\CTF.AsmListCache.FMPDefault1"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de070b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d40cddc00"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de070b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "MutexName",
                "value": "CicLoadWinStaWinSta0"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.CtfMonitorInstMutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "LaunchUserOOBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8372:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextInputFramework.dll"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a6e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93160000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0035b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9346c000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "wintypes.dll"
              }
            ],
            "repeated": 2,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93840000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95450000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00033000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95480000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f0"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92180000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00155000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff922bd000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92275000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 1,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92275000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\r\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x0fZ\\x05\\xde\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95450000"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93840000"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92180000"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93160000"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a6e0000"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ntmarta"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95450000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff95456930"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93840000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff938970e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\WinTypes"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92180000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff921aad60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93160000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff931e2fe0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\TextInputFramework"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a6e0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8a71e8e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000001"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": "EnableAnchorContext"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext"
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:31:59,315",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a960000"
              },
              {
                "name": "RegionSize",
                "value": "0x00800000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "58"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000032c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a862000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a865000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000358"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97d60000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "IsGUIThread"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d88050"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8372:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d672c0"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "CreateWindowExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d67720"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "DefWindowProcW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ceccb0"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "SetWindowLongPtrW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d6b7c0"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "SetTimer"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d83c70"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97d60000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 795
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2612"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d8bab0"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "GetWindowLongPtrW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d6f830"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "GetWindowThreadProcessId"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d63500"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "SendMessageCallbackW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d87e20"
              }
            ],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000036c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-com-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96ff0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-com-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateGuid"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970437e0"
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a960000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2582"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d870e0"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "srand",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "seed",
                "value": "0x6a18c25f"
              }
            ],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8372:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              }
            ],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "ValueName",
                "value": "IsVailContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Input"
              },
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "ValueName",
                "value": "ResyncResetTime"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "ValueName",
                "value": "MaxResyncAttempts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a867000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055fd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "iertutil.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x4031c471a94c5fd2"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x9d40cde990"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 858
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 859
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#32512"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#22"
              },
              {
                "name": "Name",
                "value": "#32512"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055ff000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msctf.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97f00000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\MSCTF.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 865
          },
          {
            "timestamp": "2026-05-28 22:31:59,330",
            "thread_id": "7460",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 867
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2541"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d94230"
              }
            ],
            "repeated": 0,
            "id": 869
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "PostMessageW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d81110"
              }
            ],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 873
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "228"
              },
              {
                "name": "y",
                "value": "526"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "228"
              },
              {
                "name": "y",
                "value": "526"
              }
            ],
            "repeated": 1,
            "id": 877
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 879
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2613"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d83de0"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726aefdf4",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a868000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05601000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-05-28 22:31:59,346",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05607000"
              },
              {
                "name": "RegionSize",
                "value": "0x00015000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05600000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 890
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05600000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x0000038c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000038c"
              },
              {
                "name": "SubKey",
                "value": "MS Shell Dlg"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg"
              }
            ],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 895
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "229"
              },
              {
                "name": "y",
                "value": "527"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "229"
              },
              {
                "name": "y",
                "value": "527"
              }
            ],
            "repeated": 0,
            "id": 899
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 900
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "230"
              },
              {
                "name": "y",
                "value": "529"
              }
            ],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "230"
              },
              {
                "name": "y",
                "value": "529"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-05-28 22:31:59,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 2,
            "id": 905
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "232"
              },
              {
                "name": "y",
                "value": "531"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "232"
              },
              {
                "name": "y",
                "value": "531"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 909
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089d9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "234"
              },
              {
                "name": "y",
                "value": "533"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 912
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "237"
              },
              {
                "name": "y",
                "value": "535"
              }
            ],
            "repeated": 1,
            "id": 913
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 914
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "237"
              },
              {
                "name": "y",
                "value": "535"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 916
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "239"
              },
              {
                "name": "y",
                "value": "537"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 918
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "239"
              },
              {
                "name": "y",
                "value": "537"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "243"
              },
              {
                "name": "y",
                "value": "541"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 921
          },
          {
            "timestamp": "2026-05-28 22:31:59,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "243"
              },
              {
                "name": "y",
                "value": "541"
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-05-28 22:31:59,408",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "246"
              },
              {
                "name": "y",
                "value": "542"
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-05-28 22:31:59,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 924
          },
          {
            "timestamp": "2026-05-28 22:31:59,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "246"
              },
              {
                "name": "y",
                "value": "542"
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-05-28 22:31:59,408",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "281"
              },
              {
                "name": "y",
                "value": "566"
              }
            ],
            "repeated": 0,
            "id": 926
          },
          {
            "timestamp": "2026-05-28 22:31:59,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-05-28 22:31:59,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "281"
              },
              {
                "name": "y",
                "value": "566"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-05-28 22:31:59,440",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-05-28 22:31:59,440",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "281"
              },
              {
                "name": "y",
                "value": "566"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-05-28 22:31:59,440",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-05-28 22:31:59,440",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "281"
              },
              {
                "name": "y",
                "value": "566"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "347"
              },
              {
                "name": "y",
                "value": "602"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "347"
              },
              {
                "name": "y",
                "value": "602"
              }
            ],
            "repeated": 1,
            "id": 935
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "347"
              },
              {
                "name": "y",
                "value": "602"
              }
            ],
            "repeated": 0,
            "id": 937
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "356"
              },
              {
                "name": "y",
                "value": "607"
              }
            ],
            "repeated": 0,
            "id": 938
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 939
          },
          {
            "timestamp": "2026-05-28 22:31:59,455",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "356"
              },
              {
                "name": "y",
                "value": "607"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "433"
              },
              {
                "name": "y",
                "value": "641"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "433"
              },
              {
                "name": "y",
                "value": "641"
              }
            ],
            "repeated": 1,
            "id": 943
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 944
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "433"
              },
              {
                "name": "y",
                "value": "641"
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "441"
              },
              {
                "name": "y",
                "value": "644"
              }
            ],
            "repeated": 0,
            "id": 946
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-05-28 22:31:59,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "441"
              },
              {
                "name": "y",
                "value": "644"
              }
            ],
            "repeated": 0,
            "id": 948
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "449"
              },
              {
                "name": "y",
                "value": "647"
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 950
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "449"
              },
              {
                "name": "y",
                "value": "647"
              }
            ],
            "repeated": 0,
            "id": 951
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "465"
              },
              {
                "name": "y",
                "value": "654"
              }
            ],
            "repeated": 0,
            "id": 952
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "465"
              },
              {
                "name": "y",
                "value": "654"
              }
            ],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "470"
              },
              {
                "name": "y",
                "value": "655"
              }
            ],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-05-28 22:31:59,502",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "470"
              },
              {
                "name": "y",
                "value": "655"
              }
            ],
            "repeated": 0,
            "id": 957
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "475"
              },
              {
                "name": "y",
                "value": "658"
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 959
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "475"
              },
              {
                "name": "y",
                "value": "658"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "482"
              },
              {
                "name": "y",
                "value": "659"
              }
            ],
            "repeated": 0,
            "id": 961
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "482"
              },
              {
                "name": "y",
                "value": "659"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "487"
              },
              {
                "name": "y",
                "value": "663"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-05-28 22:31:59,518",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "487"
              },
              {
                "name": "y",
                "value": "663"
              }
            ],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-05-28 22:31:59,533",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x9d40cdf1b0"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-05-28 22:31:59,549",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-05-28 22:31:59,549",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-05-28 22:31:59,549",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 2,
            "id": 970
          },
          {
            "timestamp": "2026-05-28 22:31:59,549",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "517"
              },
              {
                "name": "y",
                "value": "674"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-05-28 22:31:59,549",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-05-28 22:31:59,549",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "517"
              },
              {
                "name": "y",
                "value": "674"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "526"
              },
              {
                "name": "y",
                "value": "678"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "526"
              },
              {
                "name": "y",
                "value": "678"
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 979
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "526"
              },
              {
                "name": "y",
                "value": "678"
              }
            ],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "526"
              },
              {
                "name": "y",
                "value": "678"
              }
            ],
            "repeated": 0,
            "id": 982
          },
          {
            "timestamp": "2026-05-28 22:31:59,565",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "541"
              },
              {
                "name": "y",
                "value": "684"
              }
            ],
            "repeated": 0,
            "id": 984
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "541"
              },
              {
                "name": "y",
                "value": "684"
              }
            ],
            "repeated": 1,
            "id": 986
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "541"
              },
              {
                "name": "y",
                "value": "684"
              }
            ],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "542"
              },
              {
                "name": "y",
                "value": "684"
              }
            ],
            "repeated": 0,
            "id": 989
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "542"
              },
              {
                "name": "y",
                "value": "684"
              }
            ],
            "repeated": 0,
            "id": 991
          },
          {
            "timestamp": "2026-05-28 22:31:59,596",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "543"
              },
              {
                "name": "y",
                "value": "685"
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "543"
              },
              {
                "name": "y",
                "value": "685"
              }
            ],
            "repeated": 1,
            "id": 994
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 995
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "543"
              },
              {
                "name": "y",
                "value": "685"
              }
            ],
            "repeated": 1,
            "id": 996
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 997
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "543"
              },
              {
                "name": "y",
                "value": "685"
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "545"
              },
              {
                "name": "y",
                "value": "686"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "545"
              },
              {
                "name": "y",
                "value": "686"
              }
            ],
            "repeated": 1,
            "id": 1001
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-05-28 22:31:59,612",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "545"
              },
              {
                "name": "y",
                "value": "686"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-05-28 22:31:59,643",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-05-28 22:31:59,643",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "545"
              },
              {
                "name": "y",
                "value": "686"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-05-28 22:31:59,643",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-05-28 22:31:59,643",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "545"
              },
              {
                "name": "y",
                "value": "686"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-05-28 22:31:59,658",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "546"
              },
              {
                "name": "y",
                "value": "686"
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-05-28 22:31:59,658",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-05-28 22:31:59,658",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "547"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 1,
            "id": 1010
          },
          {
            "timestamp": "2026-05-28 22:31:59,658",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-05-28 22:31:59,658",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "547"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 1,
            "id": 1012
          },
          {
            "timestamp": "2026-05-28 22:31:59,705",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1013
          },
          {
            "timestamp": "2026-05-28 22:31:59,705",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "547"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 0,
            "id": 1014
          },
          {
            "timestamp": "2026-05-28 22:31:59,768",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 4,
            "id": 1015
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wbemcomn"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8cfe0000"
              }
            ],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 1018
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 1020
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1021
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000003d4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x1de055f70a0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10600"
              },
              {
                "name": "ProcessId",
                "value": "8372"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "10600",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "10600",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x1de055f70a0"
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-05-28 22:32:01,377",
            "thread_id": "2644",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a869000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1026
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2644",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2644",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x1de05590b50"
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2644",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "9288",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1030
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "9288",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x1de05590b50"
              }
            ],
            "repeated": 0,
            "id": 1031
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1032
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1033
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 1034
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 1035
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1036
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1037
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1038
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\fastprox"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 1039
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1040
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 1041
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\amsi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d520000"
              }
            ],
            "repeated": 0,
            "id": 1042
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "amsi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d520000"
              }
            ],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 1044
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96260000"
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files\\Windows Defender\\MpOav"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d4d0000"
              }
            ],
            "repeated": 0,
            "id": 1046
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1047
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1048
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1049
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-05-28 22:32:01,393",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 1051
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\version"
              },
              {
                "name": "DllBase",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1053
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\version.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files\\Windows Defender\\MpOAV.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d4d0000"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 7,
            "id": 1058
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "\\\\.\\root\\cimv2"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1059
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad8c09",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1060
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_OperatingSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1061
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fd28000"
              },
              {
                "name": "ModuleName",
                "value": "fastprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1062
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fd28000"
              },
              {
                "name": "ModuleName",
                "value": "fastprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1063
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a61000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1064
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a61000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1065
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1066
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1067
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000286"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{027947E1-D731-11CE-A357-000000000001}"
              },
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              }
            ],
            "repeated": 0,
            "id": 1068
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000426"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1069
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1070
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              }
            ],
            "repeated": 0,
            "id": 1071
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              }
            ],
            "repeated": 0,
            "id": 1072
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000392"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1073
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1074
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1075
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xc8/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x9d\\x00\\x00\\x00\\x10\\xc9/A\\x9d\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1076
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1077
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1078
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000426"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1079
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1080
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1081
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1082
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1083
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000426"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1084
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1085
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1086
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 1087
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1088
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              }
            ],
            "repeated": 0,
            "id": 1089
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1090
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1091
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xc6/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x9d\\x00\\x00\\x00\\xa0\\xc7/A\\x9d\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1092
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1093
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1094
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000426"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1095
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1096
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1097
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xc6/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x9d\\x00\\x00\\x00\\xa0\\xc7/A\\x9d\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1098
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1099
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1100
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000426"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1101
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              }
            ],
            "repeated": 0,
            "id": 1102
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1103
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1104
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000392"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1105
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1106
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1107
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xc4/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x9d\\x00\\x00\\x00\\xd0\\xc5/A\\x9d\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1108
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1109
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1110
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000426"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1111
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1112
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1113
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1114
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1115
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000426"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1116
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1117
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1118
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 1119
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1120
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              }
            ],
            "repeated": 0,
            "id": 1121
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1122
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1123
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xc3/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x9d\\x00\\x00\\x00`\\xc4/A\\x9d\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1124
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1125
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1126
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000426"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1127
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1128
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1129
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xc3/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x9d\\x00\\x00\\x00`\\xc4/A\\x9d\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1130
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1131
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1132
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000426"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1133
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000426"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 1134
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 1135
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1136
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1137
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xc2/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00&\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x9d\\x00\\x00\\x00\\xa0\\xc3/A\\x9d\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1138
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1139
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000426"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1140
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000426"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1141
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000392"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1142
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000042a"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 1143
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              }
            ],
            "repeated": 0,
            "id": 1144
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              }
            ],
            "repeated": 0,
            "id": 1145
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000286"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000426"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1146
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000426"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1147
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000426"
              }
            ],
            "repeated": 0,
            "id": 1148
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1149
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1150
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1151
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1152
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1153
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000286"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000042e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1154
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000042e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1155
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1156
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              }
            ],
            "repeated": 0,
            "id": 1157
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042e"
              }
            ],
            "repeated": 0,
            "id": 1158
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1159
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1160
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1161
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1162
          },
          {
            "timestamp": "2026-05-28 22:32:01,408",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000286"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000042e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1163
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000042e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1164
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1165
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              }
            ],
            "repeated": 0,
            "id": 1166
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042e"
              }
            ],
            "repeated": 0,
            "id": 1167
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1168
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1169
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05629000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1170
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1171
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1172
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0562b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1173
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0562e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1174
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05631000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1175
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1176
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1177
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1178
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1179
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Name, Manufacturer, Model, SystemType, UserName, DaylightInEffect FROM Win32_ComputerSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1180
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1181
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1182
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1183
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1184
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1185
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1186
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1187
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1188
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1189
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1190
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1191
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1192
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1193
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1194
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1195
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Caption FROM Win32_PageFileUsage"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1196
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1197
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1198
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1199
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1200
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1201
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1202
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1203
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1204
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1205
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1206
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1207
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1208
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1209
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1210
          },
          {
            "timestamp": "2026-05-28 22:32:01,424",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1211
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CSDVersion"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1212
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ae4d1d",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1213
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1214
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Caption"
              },
              {
                "name": "Value",
                "value": "Microsoft Windows 10 Pro"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1215
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1216
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "10.0.19045"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1217
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1218
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "BuildNumber"
              },
              {
                "name": "Value",
                "value": "19045"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1219
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1220
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "OtherTypeDescription"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1221
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1222
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad918d",
            "parentcaller": "0x7ff726adbcbc",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1223
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "Microsoft Corporation"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1224
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1225
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT RemainingGracePeriod, ActivationRequired FROM Win32_WindowsProductActivation"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1226
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1227
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1228
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1229
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1230
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1231
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1232
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1233
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1234
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1235
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1236
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1237
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1238
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WBEM\\CIMOM"
              },
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM"
              }
            ],
            "repeated": 0,
            "id": 1239
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "ValueName",
                "value": "EnableObjectValidation"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation"
              }
            ],
            "repeated": 0,
            "id": 1240
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 1241
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1242
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1243
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1244
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1245
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b70",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#30"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1246
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "JOHNS-PC"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1247
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1248
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "ASUS"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1249
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1250
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Model"
              },
              {
                "name": "Value",
                "value": "PRIME B450M-A II"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1251
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1252
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SystemType"
              },
              {
                "name": "Value",
                "value": "x64-based PC"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1253
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ad79c3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 1254
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "system",
            "api": "WMI_GetObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ObjectPath",
                "value": "\\\\.\\root\\cimv2:Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1255
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1256
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1257
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1258
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05634000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1259
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae4e59",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1260
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae4e59",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 1261
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae4e59",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 1262
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae4ee9",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70bf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#38"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1263
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae4f40",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1264
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae4f7a",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "HARDWARE\\DESCRIPTION\\System\\BIOS"
              },
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS"
              }
            ],
            "repeated": 0,
            "id": 1265
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae4fbc",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "SystemSKU"
              },
              {
                "name": "Data",
                "value": "SKU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\SystemSKU"
              }
            ],
            "repeated": 0,
            "id": 1266
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae5048",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1267
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "10.0.19045"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1268
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ae5132",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1269
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Name,MaxClockSpeed,NumberOfCores,NumberOfLogicalProcessors FROM Win32_Processor"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1270
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1271
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1272
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1273
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1274
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1275
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1276
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1277
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1278
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1279
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1280
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1281
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1282
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "Intel Core Processor (Skylake, IBRS)"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1283
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1284
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "MaxClockSpeed"
              },
              {
                "name": "Value",
                "value": "3686"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1285
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1286
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "NumberOfCores"
              },
              {
                "name": "Value",
                "value": "6"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1287
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1288
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "NumberOfLogicalProcessors"
              },
              {
                "name": "Value",
                "value": "6"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1289
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1290
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1291
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1292
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1293
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1294
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1295
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1296
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Manufacturer, Version, SMBIOSPresent, SMBIOSBIOSVersion, ReleaseDate, SMBIOSMajorVersion, SMBIOSMinorVersion, BIOSVersion FROM Win32_BIOS"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1297
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1298
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1299
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1300
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1301
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1302
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1303
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1304
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1305
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1306
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1307
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1308
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1309
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1310
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1311
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1312
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSPresent"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1313
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae52e3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1314
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSBIOSVersion"
              },
              {
                "name": "Value",
                "value": "3603"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1315
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ae5328",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1316
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae5365",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b70",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#30"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1317
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae537b",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1318
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "American Megatrends Inc."
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1319
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1320
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSBIOSVersion"
              },
              {
                "name": "Value",
                "value": "3603"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1321
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1322
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad76fa",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ReleaseDate"
              },
              {
                "name": "Value",
                "value": "20211105000000.000000+000"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1323
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad771e",
            "parentcaller": "0x7ff726adb3a6",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1324
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSMajorVersion"
              },
              {
                "name": "Value",
                "value": "2"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1325
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1326
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSMinorVersion"
              },
              {
                "name": "Value",
                "value": "8"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1327
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1328
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1329
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1330
          },
          {
            "timestamp": "2026-05-28 22:32:01,440",
            "thread_id": "2864",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000410"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "HARDWARE\\DESCRIPTION\\System\\BIOS"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS"
              }
            ],
            "repeated": 0,
            "id": 1331
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "ValueName",
                "value": "ECFirmwareMajorRelease"
              },
              {
                "name": "Data",
                "value": "255"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMajorRelease"
              }
            ],
            "repeated": 0,
            "id": 1332
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 1333
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1334
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1335
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000410"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "HARDWARE\\DESCRIPTION\\System\\BIOS"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS"
              }
            ],
            "repeated": 0,
            "id": 1336
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "ValueName",
                "value": "ECFirmwareMinorRelease"
              },
              {
                "name": "Data",
                "value": "255"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMinorRelease"
              }
            ],
            "repeated": 0,
            "id": 1337
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 1338
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae5678",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b90",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#32"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1339
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae574c",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1340
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae57ab",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "90"
              }
            ],
            "repeated": 0,
            "id": 1341
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae57d9",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70ce0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#2051"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1342
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Manufacturer, Product, Version FROM Win32_BaseBoard"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1343
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1344
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1345
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1346
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1347
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1348
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1349
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1350
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1351
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1352
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1353
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1354
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1355
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1356
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1357
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1358
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae589d",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b90",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#32"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1359
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae5900",
            "parentcaller": "0x7ff726ada7a1",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "75"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1360
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae598a",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#48"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1361
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2d1a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70bf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#38"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1362
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2d74",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1363
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2d8a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70bf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#38"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1364
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2de4",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1365
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2e1f",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\CurrentControlSet\\Control\\SecureBoot\\State"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecureBoot\\State"
              }
            ],
            "repeated": 0,
            "id": 1366
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2ebf",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c00",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#47"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1367
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2f96",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1368
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2f96",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\fveapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1369
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2f96",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff8d860000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\fveapi.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1370
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fb8",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveGetSecureBootBindingState"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d889060"
              }
            ],
            "repeated": 0,
            "id": 1371
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1372
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1373
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1374
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000438"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610d4"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x10\\x00\"\\x00\\x10\\x00\\x12\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x002\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1375
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1376
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\SEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1377
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\HEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1378
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\.\\C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 1379
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1380
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000440"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1381
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1382
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000438"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x18\r\\x8f\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1383
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1384
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000440"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1385
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1386
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0564e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1387
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000438"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561083"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\xb1b\\xcd\\xf1\\xee\\xdc\\x01,\\x00\\x08\\x00\n\\x00\\x01\\x00\\x00\\x00\\x00\\x00.\\xe8\\xe0\\x8f1\\xfa\\x9c\\xa5\\xb0XVs\\x9c\\xa9!\\xefeR\\xb5\\x8f\\xf2\\xcd\\xcc\\xed_J1\\xf35\\xd2H\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1388
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software"
              },
              {
                "name": "Handle",
                "value": "0x00000440"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software"
              }
            ],
            "repeated": 0,
            "id": 1389
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System"
              },
              {
                "name": "Handle",
                "value": "0x00000444"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System"
              }
            ],
            "repeated": 0,
            "id": 1390
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1391
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 1392
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 1393
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1394
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 1395
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000044c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1396
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1397
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1398
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1399
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1400
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1401
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "imagehlp.dll"
              }
            ],
            "repeated": 0,
            "id": 1402
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000450"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001d000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1403
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98577000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1404
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1405
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1406
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1407
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1408
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1409
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 1410
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 1411
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1412
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1413
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1414
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 1415
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 1416
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\imagehlp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff985623b0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1417
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\tbs"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8e465fa0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1418
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1419
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1420
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0000000",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE"
              },
              {
                "name": "FileName",
                "value": "\\??\\TPM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 1421
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": false,
            "return": "0xffffffffc0000008",
            "pretty_return": "INVALID_HANDLE",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1422
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1423
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 1424
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1425
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000444"
              }
            ],
            "repeated": 0,
            "id": 1426
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae303b",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#48"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1427
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1428
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1429
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 1430
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1431
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 1432
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1433
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1434
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1435
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 1436
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 1437
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 1438
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1439
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1440
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1441
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1442
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "WindowsDirectory"
              },
              {
                "name": "Value",
                "value": "C:\\Windows"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1443
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1444
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SystemDirectory"
              },
              {
                "name": "Value",
                "value": "C:\\Windows\\system32"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1445
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1446
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "BootDevice"
              },
              {
                "name": "Value",
                "value": "\\Device\\HarddiskVolume1"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1447
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1448
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Locale"
              },
              {
                "name": "Value",
                "value": "0409"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1449
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adb538",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1450
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x1de089c0001",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "winnlsres.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1451
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de089c04e8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x1de089c0001"
              },
              {
                "name": "Type",
                "value": "#10"
              },
              {
                "name": "Name",
                "value": "#1"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1452
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de089c08b8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x1de089c0001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de089c04e8"
              }
            ],
            "repeated": 0,
            "id": 1453
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de089c04f8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x1de089c0001"
              },
              {
                "name": "Type",
                "value": "#10"
              },
              {
                "name": "Name",
                "value": "#2"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1454
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de089c3100",
            "arguments": [
              {
                "name": "Module",
                "value": "0x1de089c0001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de089c04f8"
              }
            ],
            "repeated": 0,
            "id": 1455
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "SizeofResource",
            "status": true,
            "return": "0x00001c20",
            "arguments": [
              {
                "name": "ModuleHandle",
                "value": "0x1de089c0001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de089c04f8"
              }
            ],
            "repeated": 0,
            "id": 1456
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de08ad1108",
            "arguments": [
              {
                "name": "Module",
                "value": "0x1de089c0001"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#3"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1457
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1de08ad1b4c",
            "arguments": [
              {
                "name": "Module",
                "value": "0x1de089c0001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1de08ad1108"
              }
            ],
            "repeated": 0,
            "id": 1458
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SystemDirectory"
              },
              {
                "name": "Value",
                "value": "C:\\Windows\\system32"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1459
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ad946a",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1460
          },
          {
            "timestamp": "2026-05-28 22:32:01,455",
            "thread_id": "2864",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "system",
            "api": "WMI_GetObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ObjectPath",
                "value": "\\\\.\\root\\cimv2:CIM_DataFile.Name='C:\\Windows\\system32\\hal.dll'"
              }
            ],
            "repeated": 0,
            "id": 1461
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1462
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1463
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1464
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1465
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726adaced",
            "parentcaller": "0x7ff726adc397",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a86c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1466
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "10.0.19041.3636"
              },
              {
                "name": "Class",
                "value": "CIM_DataFile"
              }
            ],
            "repeated": 0,
            "id": 1467
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1468
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1469
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UserName"
              },
              {
                "name": "Value",
                "value": "JOHNS-PC\\admin"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1470
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1471
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DaylightInEffect"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1472
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae5b58",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1473
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_TimeZone"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1474
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1475
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1476
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1477
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1478
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1479
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1480
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1481
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1482
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1483
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1484
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1485
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1486
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1487
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1488
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1489
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1490
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DaylightName"
              },
              {
                "name": "Value",
                "value": "Eastern Daylight Time"
              },
              {
                "name": "Class",
                "value": "Win32_TimeZone"
              }
            ],
            "repeated": 0,
            "id": 1491
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1492
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c26",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1493
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c42",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "GetPhysicallyInstalledSystemMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TotalMemoryInKilobytes",
                "value": "8388608"
              }
            ],
            "repeated": 0,
            "id": 1494
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1495
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "PROPSYS.dll"
              }
            ],
            "repeated": 0,
            "id": 1496
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              }
            ],
            "repeated": 0,
            "id": 1497
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1498
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000454"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              }
            ],
            "repeated": 0,
            "id": 1499
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000458"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91eb0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f6000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1500
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1501
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1502
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1503
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1504
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1505
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6c000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1506
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1507
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1508
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6c000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1509
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91eb0000"
              }
            ],
            "repeated": 0,
            "id": 1510
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff91eb0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "propsys.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000022"
              }
            ],
            "repeated": 0,
            "id": 1511
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\propsys"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91eb0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff91ef2b20"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1512
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1513
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1514
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 1515
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\PROPSYS.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1516
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\propsys.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 1517
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000464"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08ae0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fe440"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1518
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1519
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT TotalPhysicalMemory FROM Win32_LogicalMemoryConfiguration"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1520
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1521
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1522
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1523
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1524
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1525
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05657000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1526
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1527
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1528
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1529
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1530
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1531
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1532
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1533
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1534
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1535
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1536
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1537
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT TotalPhysicalMemory FROM Win32_ComputerSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1538
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1539
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1540
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1541
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1542
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1543
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1544
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1545
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1546
          },
          {
            "timestamp": "2026-05-28 22:32:01,471",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1547
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1548
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1549
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1550
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1551
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1552
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1553
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7851",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TotalPhysicalMemory"
              },
              {
                "name": "Value",
                "value": "8589389824"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1554
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7871",
            "parentcaller": "0x7ff726ae5dcd",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1555
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae5e9a",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1556
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "FreePhysicalMemory"
              },
              {
                "name": "Value",
                "value": "5184320"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1557
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1558
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TotalVirtualMemorySize"
              },
              {
                "name": "Value",
                "value": "10354156"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1559
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1560
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "FreeVirtualMemory"
              },
              {
                "name": "Value",
                "value": "7205364"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1561
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1562
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SizeStoredInPagingFiles"
              },
              {
                "name": "Value",
                "value": "1966080"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1563
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1564
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1565
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Caption"
              },
              {
                "name": "Value",
                "value": "C:\\pagefile.sys"
              },
              {
                "name": "Class",
                "value": "Win32_PageFileUsage"
              }
            ],
            "repeated": 0,
            "id": 1566
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1567
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae2b9c",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c70",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#66"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1568
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae2bb1",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1569
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae2bd4",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "202"
              }
            ],
            "repeated": 0,
            "id": 1570
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae2bf8",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#48"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1571
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7fe9",
            "parentcaller": "0x7ff726ae3a6d",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1572
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7ffe",
            "parentcaller": "0x7ff726ae3a6d",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b00",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#23"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1573
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad8013",
            "parentcaller": "0x7ff726ae3a6d",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1574
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1575
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1576
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1577
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "\\\\.\\root\\Microsoft\\Windows\\DeviceGuard"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1578
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad8c09",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1579
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_DeviceGuard"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1580
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1581
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1582
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1583
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1584
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1585
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1586
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1587
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1588
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1589
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1590
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1591
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1592
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1593
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1594
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1595
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "VirtualizationBasedSecurityStatus"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1596
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae3b33",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1597
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "RequiredSecurityProperties"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1598
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "AvailableSecurityProperties"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1599
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityServicesConfigured"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1600
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityServicesRunning"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1601
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CodeIntegrityPolicyEnforcementStatus"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1602
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae3bed",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1603
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UsermodeCodeIntegrityPolicyEnforcementStatus"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1604
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae3c15",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1605
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7281",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "VirtualMachineIsolation"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1606
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad72a1",
            "parentcaller": "0x7ff726ae3c3d",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1607
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "VirtualMachineIsolationProperties"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1608
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae3652",
            "parentcaller": "0x7ff726ae3cba",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c20",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#54"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1609
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad8122",
            "parentcaller": "0x7ff726ae3d30",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1610
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ad8122",
            "parentcaller": "0x7ff726ae3d30",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1611
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae455a",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#60"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1612
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae45b4",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1613
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae45df",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1614
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae45df",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "fveapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1615
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae45df",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff8d860000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "fveapi.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1616
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae461c",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveQueryDeviceEncryptionSupport"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d884b90"
              }
            ],
            "repeated": 0,
            "id": 1617
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1618
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1619
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1620
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000046c"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610d4"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x10\\x00\"\\x00\\x10\\x00\\x12\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x002\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1621
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1622
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\SEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1623
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\HEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1624
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\.\\C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 1625
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1626
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000474"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1627
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 1628
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000046c"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x18\r\\x8f\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1629
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1630
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1631
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1632
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000046c"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561083"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xee\\xfdg\\xcd\\xf1\\xee\\xdc\\x01,\\x00\\x08\\x00\n\\x00\\x01\\x00\\x00\\x00\\x00\\x000\\xb2\\x8bJL4[\\x93`\\xd2X\\xc7\\x1aev\\xec\\xa4\\xedN\\xca\\xd2\\xacF\\x0b@\\x8b\\x13@\\x0e\\x80\\xfb5\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1633
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1634
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 1635
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 1636
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000046c"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610c8"
              },
              {
                "name": "InBuffer",
                "value": "\\x08\\x00\\x01\\x00\n\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1637
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x82000000",
                "pretty_value": "0x82000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 0,
            "id": 1638
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x82000000",
                "pretty_value": "0x82000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\"
              }
            ],
            "repeated": 0,
            "id": 1639
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1640
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "PortableOperatingSystem"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\PortableOperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1641
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1642
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1643
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "66"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x00"
              }
            ],
            "repeated": 0,
            "id": 1644
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": false,
            "return": "0xffffffffc0000225",
            "pretty_return": "NOT_FOUND",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "166"
              }
            ],
            "repeated": 0,
            "id": 1645
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1646
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1647
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\HSTI"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\HSTI"
              }
            ],
            "repeated": 0,
            "id": 1648
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "HSTIVerificationRequired"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\HSTI\\HSTIVerificationRequired"
              }
            ],
            "repeated": 0,
            "id": 1649
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1650
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1651
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "13"
              },
              {
                "name": "MaxValueNameLength",
                "value": "35"
              },
              {
                "name": "MaxValueLength",
                "value": "28"
              }
            ],
            "repeated": 0,
            "id": 1652
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1653
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1654
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1655
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1656
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1657
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "CardBus Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\CardBus Bridge"
              }
            ],
            "repeated": 0,
            "id": 1658
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "CardBus Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0607"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\CardBus Bridge"
              }
            ],
            "repeated": 0,
            "id": 1659
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "EISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1660
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "EISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0602"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1661
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "EISA Plug and Play bus"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1662
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "EISA Plug and Play bus"
              },
              {
                "name": "Data",
                "value": "PNP0A01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1663
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "IEEE 1394"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "28"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\IEEE 1394"
              }
            ],
            "repeated": 0,
            "id": 1664
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "IEEE 1394"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0C0010"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\IEEE 1394"
              }
            ],
            "repeated": 0,
            "id": 1665
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "ISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1666
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "ISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0601"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1667
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1668
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus"
              },
              {
                "name": "Data",
                "value": "PNP0A00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1669
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus with VL slots"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus with VL slots"
              }
            ],
            "repeated": 0,
            "id": 1670
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus with VL slots"
              },
              {
                "name": "Data",
                "value": "PNP0A04"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus with VL slots"
              }
            ],
            "repeated": 0,
            "id": 1671
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "PCI bus"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI bus"
              }
            ],
            "repeated": 0,
            "id": 1672
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "PCI bus"
              },
              {
                "name": "Data",
                "value": "PNP0A03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI bus"
              }
            ],
            "repeated": 0,
            "id": 1673
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1674
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Data",
                "value": "PNP0A08"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1675
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "PCI-to-PCI Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1676
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "PCI-to-PCI Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0604"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1677
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "PCMCIA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCMCIA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1678
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "PCMCIA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0605"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCMCIA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1679
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "SemiTransparent PCI-to-PCI Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\SemiTransparent PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1680
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "SemiTransparent PCI-to-PCI Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0609"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\SemiTransparent PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1681
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "ThunderBolt"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ThunderBolt"
              }
            ],
            "repeated": 0,
            "id": 1682
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "ThunderBolt"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0C0A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ThunderBolt"
              }
            ],
            "repeated": 0,
            "id": 1683
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1684
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1685
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1686
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1687
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "172"
              },
              {
                "name": "MaxValueNameLength",
                "value": "78"
              },
              {
                "name": "MaxValueLength",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1688
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1689
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1690
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1691
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05668000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1692
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1693
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1694
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "BayTrail ISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\BayTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1695
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "BayTrail ISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_0F1C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\BayTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1696
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 1"
              }
            ],
            "repeated": 0,
            "id": 1697
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9CC3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 1"
              }
            ],
            "repeated": 0,
            "id": 1698
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 2"
              }
            ],
            "repeated": 0,
            "id": 1699
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9CC7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 2"
              }
            ],
            "repeated": 0,
            "id": 1700
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 3"
              }
            ],
            "repeated": 0,
            "id": 1701
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9CC9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 3"
              }
            ],
            "repeated": 0,
            "id": 1702
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 1"
              }
            ],
            "repeated": 0,
            "id": 1703
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C90"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 1"
              }
            ],
            "repeated": 0,
            "id": 1704
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 2"
              }
            ],
            "repeated": 0,
            "id": 1705
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C92"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 2"
              }
            ],
            "repeated": 0,
            "id": 1706
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 3"
              }
            ],
            "repeated": 0,
            "id": 1707
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C94"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 3"
              }
            ],
            "repeated": 0,
            "id": 1708
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 4"
              }
            ],
            "repeated": 0,
            "id": 1709
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C96"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 4"
              }
            ],
            "repeated": 0,
            "id": 1710
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 5"
              }
            ],
            "repeated": 0,
            "id": 1711
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C98"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 5"
              }
            ],
            "repeated": 0,
            "id": 1712
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 6"
              }
            ],
            "repeated": 0,
            "id": 1713
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C9A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 6"
              }
            ],
            "repeated": 0,
            "id": 1714
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D80"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D80"
              }
            ],
            "repeated": 0,
            "id": 1715
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D80"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D80"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D80"
              }
            ],
            "repeated": 0,
            "id": 1716
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D81"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D81"
              }
            ],
            "repeated": 0,
            "id": 1717
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D81"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D81"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D81"
              }
            ],
            "repeated": 0,
            "id": 1718
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D82"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D82"
              }
            ],
            "repeated": 0,
            "id": 1719
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D82"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D82"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D82"
              }
            ],
            "repeated": 0,
            "id": 1720
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D83"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D83"
              }
            ],
            "repeated": 0,
            "id": 1721
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D83"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D83"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D83"
              }
            ],
            "repeated": 0,
            "id": 1722
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D84"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D84"
              }
            ],
            "repeated": 0,
            "id": 1723
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D84"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D84"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D84"
              }
            ],
            "repeated": 0,
            "id": 1724
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D85"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D85"
              }
            ],
            "repeated": 0,
            "id": 1725
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D85"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D85"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D85"
              }
            ],
            "repeated": 0,
            "id": 1726
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D86"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D86"
              }
            ],
            "repeated": 0,
            "id": 1727
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D86"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D86"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D86"
              }
            ],
            "repeated": 0,
            "id": 1728
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D87"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D87"
              }
            ],
            "repeated": 0,
            "id": 1729
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D87"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D87"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D87"
              }
            ],
            "repeated": 0,
            "id": 1730
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D88"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D88"
              }
            ],
            "repeated": 0,
            "id": 1731
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D88"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D88"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D88"
              }
            ],
            "repeated": 0,
            "id": 1732
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D89"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D89"
              }
            ],
            "repeated": 0,
            "id": 1733
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D89"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D89"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D89"
              }
            ],
            "repeated": 0,
            "id": 1734
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8A"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8A"
              }
            ],
            "repeated": 0,
            "id": 1735
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8A"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8A"
              }
            ],
            "repeated": 0,
            "id": 1736
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8B"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8B"
              }
            ],
            "repeated": 0,
            "id": 1737
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8B"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8B"
              }
            ],
            "repeated": 0,
            "id": 1738
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8C"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8C"
              }
            ],
            "repeated": 0,
            "id": 1739
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8C"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8C"
              }
            ],
            "repeated": 0,
            "id": 1740
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8D"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8D"
              }
            ],
            "repeated": 0,
            "id": 1741
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8D"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8D"
              }
            ],
            "repeated": 0,
            "id": 1742
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8E"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8E"
              }
            ],
            "repeated": 0,
            "id": 1743
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8E"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8E"
              }
            ],
            "repeated": 0,
            "id": 1744
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8F"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8F"
              }
            ],
            "repeated": 0,
            "id": 1745
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8F"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8F"
              }
            ],
            "repeated": 0,
            "id": 1746
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D90"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D90"
              }
            ],
            "repeated": 0,
            "id": 1747
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D90"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D90"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D90"
              }
            ],
            "repeated": 0,
            "id": 1748
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D91"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D91"
              }
            ],
            "repeated": 0,
            "id": 1749
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D91"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D91"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D91"
              }
            ],
            "repeated": 0,
            "id": 1750
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D92"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D92"
              }
            ],
            "repeated": 0,
            "id": 1751
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D92"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D92"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D92"
              }
            ],
            "repeated": 0,
            "id": 1752
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D93"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D93"
              }
            ],
            "repeated": 0,
            "id": 1753
          },
          {
            "timestamp": "2026-05-28 22:32:01,487",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D93"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D93"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D93"
              }
            ],
            "repeated": 0,
            "id": 1754
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D94"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D94"
              }
            ],
            "repeated": 0,
            "id": 1755
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D94"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D94"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D94"
              }
            ],
            "repeated": 0,
            "id": 1756
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D95"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D95"
              }
            ],
            "repeated": 0,
            "id": 1757
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D95"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D95"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D95"
              }
            ],
            "repeated": 0,
            "id": 1758
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D96"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D96"
              }
            ],
            "repeated": 0,
            "id": 1759
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D96"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D96"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D96"
              }
            ],
            "repeated": 0,
            "id": 1760
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D97"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D97"
              }
            ],
            "repeated": 0,
            "id": 1761
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D97"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D97"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D97"
              }
            ],
            "repeated": 0,
            "id": 1762
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D98"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D98"
              }
            ],
            "repeated": 0,
            "id": 1763
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D98"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D98"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D98"
              }
            ],
            "repeated": 0,
            "id": 1764
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D99"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D99"
              }
            ],
            "repeated": 0,
            "id": 1765
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D99"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D99"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D99"
              }
            ],
            "repeated": 0,
            "id": 1766
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9A"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9A"
              }
            ],
            "repeated": 0,
            "id": 1767
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9A"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9A"
              }
            ],
            "repeated": 0,
            "id": 1768
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9B"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9B"
              }
            ],
            "repeated": 0,
            "id": 1769
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9B"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9B"
              }
            ],
            "repeated": 0,
            "id": 1770
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9C"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9C"
              }
            ],
            "repeated": 0,
            "id": 1771
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9C"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9C"
              }
            ],
            "repeated": 0,
            "id": 1772
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9D"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9D"
              }
            ],
            "repeated": 0,
            "id": 1773
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9D"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9D"
              }
            ],
            "repeated": 0,
            "id": 1774
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9E"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9E"
              }
            ],
            "repeated": 0,
            "id": 1775
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9E"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9E"
              }
            ],
            "repeated": 0,
            "id": 1776
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9F"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9F"
              }
            ],
            "repeated": 0,
            "id": 1777
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9F"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9F"
              }
            ],
            "repeated": 0,
            "id": 1778
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB0"
              }
            ],
            "repeated": 0,
            "id": 1779
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB0"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB0"
              }
            ],
            "repeated": 0,
            "id": 1780
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB1"
              }
            ],
            "repeated": 0,
            "id": 1781
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB1"
              }
            ],
            "repeated": 0,
            "id": 1782
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB2"
              }
            ],
            "repeated": 0,
            "id": 1783
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB2"
              }
            ],
            "repeated": 0,
            "id": 1784
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB3"
              }
            ],
            "repeated": 0,
            "id": 1785
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB3"
              }
            ],
            "repeated": 0,
            "id": 1786
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB4"
              }
            ],
            "repeated": 0,
            "id": 1787
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB4"
              }
            ],
            "repeated": 0,
            "id": 1788
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB5"
              }
            ],
            "repeated": 0,
            "id": 1789
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB5"
              }
            ],
            "repeated": 0,
            "id": 1790
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB6"
              }
            ],
            "repeated": 0,
            "id": 1791
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB6"
              }
            ],
            "repeated": 0,
            "id": 1792
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB7"
              }
            ],
            "repeated": 0,
            "id": 1793
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB7"
              }
            ],
            "repeated": 0,
            "id": 1794
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB8"
              }
            ],
            "repeated": 0,
            "id": 1795
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB8"
              }
            ],
            "repeated": 0,
            "id": 1796
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB9"
              }
            ],
            "repeated": 0,
            "id": 1797
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB9"
              }
            ],
            "repeated": 0,
            "id": 1798
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBA"
              }
            ],
            "repeated": 0,
            "id": 1799
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBA"
              }
            ],
            "repeated": 0,
            "id": 1800
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBB"
              }
            ],
            "repeated": 0,
            "id": 1801
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBB"
              }
            ],
            "repeated": 0,
            "id": 1802
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBC"
              }
            ],
            "repeated": 0,
            "id": 1803
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBC"
              }
            ],
            "repeated": 0,
            "id": 1804
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBD"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBD"
              }
            ],
            "repeated": 0,
            "id": 1805
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBD"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBD"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBD"
              }
            ],
            "repeated": 0,
            "id": 1806
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBE"
              }
            ],
            "repeated": 0,
            "id": 1807
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBE"
              }
            ],
            "repeated": 0,
            "id": 1808
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBF"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBF"
              }
            ],
            "repeated": 0,
            "id": 1809
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBF"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBF"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBF"
              }
            ],
            "repeated": 0,
            "id": 1810
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail ISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1811
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail ISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_229C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1812
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail Root Port"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail Root Port"
              }
            ],
            "repeated": 0,
            "id": 1813
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail Root Port"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_22C8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail Root Port"
              }
            ],
            "repeated": 0,
            "id": 1814
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "ValueName",
                "value": "Geminilake LPC - 31E8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake LPC - 31E8"
              }
            ],
            "repeated": 0,
            "id": 1815
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "ValueName",
                "value": "Geminilake LPC - 31E8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31E8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake LPC - 31E8"
              }
            ],
            "repeated": 0,
            "id": 1816
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D6"
              }
            ],
            "repeated": 0,
            "id": 1817
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D6"
              }
            ],
            "repeated": 0,
            "id": 1818
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D7"
              }
            ],
            "repeated": 0,
            "id": 1819
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D7"
              }
            ],
            "repeated": 0,
            "id": 1820
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D8"
              }
            ],
            "repeated": 0,
            "id": 1821
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D8"
              }
            ],
            "repeated": 0,
            "id": 1822
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D9"
              }
            ],
            "repeated": 0,
            "id": 1823
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D9"
              }
            ],
            "repeated": 0,
            "id": 1824
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DA"
              }
            ],
            "repeated": 0,
            "id": 1825
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31DA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DA"
              }
            ],
            "repeated": 0,
            "id": 1826
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DB"
              }
            ],
            "repeated": 0,
            "id": 1827
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31DB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DB"
              }
            ],
            "repeated": 0,
            "id": 1828
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "ValueName",
                "value": "Haswell LPC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Haswell LPC"
              }
            ],
            "repeated": 0,
            "id": 1829
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "ValueName",
                "value": "Haswell LPC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C43"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Haswell LPC"
              }
            ],
            "repeated": 0,
            "id": 1830
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "68"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              }
            ],
            "repeated": 0,
            "id": 1831
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "68"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              }
            ],
            "repeated": 0,
            "id": 1832
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "69"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              }
            ],
            "repeated": 0,
            "id": 1833
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "69"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              }
            ],
            "repeated": 0,
            "id": 1834
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "70"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              }
            ],
            "repeated": 0,
            "id": 1835
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "70"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              }
            ],
            "repeated": 0,
            "id": 1836
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "71"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              }
            ],
            "repeated": 0,
            "id": 1837
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "71"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              }
            ],
            "repeated": 0,
            "id": 1838
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "72"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              }
            ],
            "repeated": 0,
            "id": 1839
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "72"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CF"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              }
            ],
            "repeated": 0,
            "id": 1840
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "73"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              }
            ],
            "repeated": 0,
            "id": 1841
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "73"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              }
            ],
            "repeated": 0,
            "id": 1842
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "74"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              }
            ],
            "repeated": 0,
            "id": 1843
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "74"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              }
            ],
            "repeated": 0,
            "id": 1844
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "75"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              }
            ],
            "repeated": 0,
            "id": 1845
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "75"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              }
            ],
            "repeated": 0,
            "id": 1846
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "76"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              }
            ],
            "repeated": 0,
            "id": 1847
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "76"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              }
            ],
            "repeated": 0,
            "id": 1848
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "77"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              }
            ],
            "repeated": 0,
            "id": 1849
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "77"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AE8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              }
            ],
            "repeated": 0,
            "id": 1850
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "78"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              }
            ],
            "repeated": 0,
            "id": 1851
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "78"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              }
            ],
            "repeated": 0,
            "id": 1852
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "79"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              }
            ],
            "repeated": 0,
            "id": 1853
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "79"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              }
            ],
            "repeated": 0,
            "id": 1854
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "80"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              }
            ],
            "repeated": 0,
            "id": 1855
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "80"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              }
            ],
            "repeated": 0,
            "id": 1856
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "81"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              }
            ],
            "repeated": 0,
            "id": 1857
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "81"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              }
            ],
            "repeated": 0,
            "id": 1858
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "82"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              }
            ],
            "repeated": 0,
            "id": 1859
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "82"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5ADA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              }
            ],
            "repeated": 0,
            "id": 1860
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "83"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              }
            ],
            "repeated": 0,
            "id": 1861
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "83"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5ADB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              }
            ],
            "repeated": 0,
            "id": 1862
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "84"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CA"
              }
            ],
            "repeated": 0,
            "id": 1863
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "84"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CA"
              }
            ],
            "repeated": 0,
            "id": 1864
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "85"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CB"
              }
            ],
            "repeated": 0,
            "id": 1865
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "85"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CB"
              }
            ],
            "repeated": 0,
            "id": 1866
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "86"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CC"
              }
            ],
            "repeated": 0,
            "id": 1867
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "86"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CC"
              }
            ],
            "repeated": 0,
            "id": 1868
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "87"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CD"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CD"
              }
            ],
            "repeated": 0,
            "id": 1869
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "87"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CD"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CD"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CD"
              }
            ],
            "repeated": 0,
            "id": 1870
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "88"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D0"
              }
            ],
            "repeated": 0,
            "id": 1871
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "88"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D0"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D0"
              }
            ],
            "repeated": 0,
            "id": 1872
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "89"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D1"
              }
            ],
            "repeated": 0,
            "id": 1873
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "89"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D1"
              }
            ],
            "repeated": 0,
            "id": 1874
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "90"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D4"
              }
            ],
            "repeated": 0,
            "id": 1875
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "90"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D4"
              }
            ],
            "repeated": 0,
            "id": 1876
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "91"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D5"
              }
            ],
            "repeated": 0,
            "id": 1877
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "91"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D5"
              }
            ],
            "repeated": 0,
            "id": 1878
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "92"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D6"
              }
            ],
            "repeated": 0,
            "id": 1879
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "92"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D6"
              }
            ],
            "repeated": 0,
            "id": 1880
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "93"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D7"
              }
            ],
            "repeated": 0,
            "id": 1881
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "93"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D7"
              }
            ],
            "repeated": 0,
            "id": 1882
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "94"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D8"
              }
            ],
            "repeated": 0,
            "id": 1883
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "94"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D8"
              }
            ],
            "repeated": 0,
            "id": 1884
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "95"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D9"
              }
            ],
            "repeated": 0,
            "id": 1885
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "95"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D9"
              }
            ],
            "repeated": 0,
            "id": 1886
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "96"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DA"
              }
            ],
            "repeated": 0,
            "id": 1887
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "96"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DA"
              }
            ],
            "repeated": 0,
            "id": 1888
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "97"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DB"
              }
            ],
            "repeated": 0,
            "id": 1889
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "97"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DB"
              }
            ],
            "repeated": 0,
            "id": 1890
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "98"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DC"
              }
            ],
            "repeated": 0,
            "id": 1891
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "98"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DC"
              }
            ],
            "repeated": 0,
            "id": 1892
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "99"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DD"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DD"
              }
            ],
            "repeated": 0,
            "id": 1893
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "99"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DD"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DD"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DD"
              }
            ],
            "repeated": 0,
            "id": 1894
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "100"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DE"
              }
            ],
            "repeated": 0,
            "id": 1895
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "100"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DE"
              }
            ],
            "repeated": 0,
            "id": 1896
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "101"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DF"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DF"
              }
            ],
            "repeated": 0,
            "id": 1897
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "101"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DF"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DF"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DF"
              }
            ],
            "repeated": 0,
            "id": 1898
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "102"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              }
            ],
            "repeated": 0,
            "id": 1899
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "102"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              }
            ],
            "repeated": 0,
            "id": 1900
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "103"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #1 - A290"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #1 - A290"
              }
            ],
            "repeated": 0,
            "id": 1901
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "103"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #1 - A290"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A290"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #1 - A290"
              }
            ],
            "repeated": 0,
            "id": 1902
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "104"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #10 - A299"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #10 - A299"
              }
            ],
            "repeated": 0,
            "id": 1903
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "104"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #10 - A299"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A299"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #10 - A299"
              }
            ],
            "repeated": 0,
            "id": 1904
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "105"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #11 - A29A"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #11 - A29A"
              }
            ],
            "repeated": 0,
            "id": 1905
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "105"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #11 - A29A"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #11 - A29A"
              }
            ],
            "repeated": 0,
            "id": 1906
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "106"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #12 - A29B"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #12 - A29B"
              }
            ],
            "repeated": 0,
            "id": 1907
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "106"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #12 - A29B"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #12 - A29B"
              }
            ],
            "repeated": 0,
            "id": 1908
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "107"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #13 - A29C"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #13 - A29C"
              }
            ],
            "repeated": 0,
            "id": 1909
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "107"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #13 - A29C"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #13 - A29C"
              }
            ],
            "repeated": 0,
            "id": 1910
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "108"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #14 - A29D"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #14 - A29D"
              }
            ],
            "repeated": 0,
            "id": 1911
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "108"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #14 - A29D"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #14 - A29D"
              }
            ],
            "repeated": 0,
            "id": 1912
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "109"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #15 - A29E"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #15 - A29E"
              }
            ],
            "repeated": 0,
            "id": 1913
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "109"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #15 - A29E"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #15 - A29E"
              }
            ],
            "repeated": 0,
            "id": 1914
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "110"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #16 - A29F"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #16 - A29F"
              }
            ],
            "repeated": 0,
            "id": 1915
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "110"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #16 - A29F"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #16 - A29F"
              }
            ],
            "repeated": 0,
            "id": 1916
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "111"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E7"
              }
            ],
            "repeated": 0,
            "id": 1917
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "111"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2E7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E7"
              }
            ],
            "repeated": 0,
            "id": 1918
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "112"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E8"
              }
            ],
            "repeated": 0,
            "id": 1919
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "112"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2E8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E8"
              }
            ],
            "repeated": 0,
            "id": 1920
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "113"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E9"
              }
            ],
            "repeated": 0,
            "id": 1921
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "113"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2E9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E9"
              }
            ],
            "repeated": 0,
            "id": 1922
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "114"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EA"
              }
            ],
            "repeated": 0,
            "id": 1923
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "114"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EA"
              }
            ],
            "repeated": 0,
            "id": 1924
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "115"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EB"
              }
            ],
            "repeated": 0,
            "id": 1925
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "115"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EB"
              }
            ],
            "repeated": 0,
            "id": 1926
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "116"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EC"
              }
            ],
            "repeated": 0,
            "id": 1927
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "116"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EC"
              }
            ],
            "repeated": 0,
            "id": 1928
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "117"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2ED"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2ED"
              }
            ],
            "repeated": 0,
            "id": 1929
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "117"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2ED"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2ED"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2ED"
              }
            ],
            "repeated": 0,
            "id": 1930
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "118"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EE"
              }
            ],
            "repeated": 0,
            "id": 1931
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "118"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EE"
              }
            ],
            "repeated": 0,
            "id": 1932
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "119"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #2 - A291"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #2 - A291"
              }
            ],
            "repeated": 0,
            "id": 1933
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "119"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #2 - A291"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A291"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #2 - A291"
              }
            ],
            "repeated": 0,
            "id": 1934
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "120"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #3 - A292"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #3 - A292"
              }
            ],
            "repeated": 0,
            "id": 1935
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "120"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #3 - A292"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A292"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #3 - A292"
              }
            ],
            "repeated": 0,
            "id": 1936
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "121"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #4 - A293"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #4 - A293"
              }
            ],
            "repeated": 0,
            "id": 1937
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "121"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #4 - A293"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A293"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #4 - A293"
              }
            ],
            "repeated": 0,
            "id": 1938
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "122"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #5 - A294"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #5 - A294"
              }
            ],
            "repeated": 0,
            "id": 1939
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "122"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #5 - A294"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A294"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #5 - A294"
              }
            ],
            "repeated": 0,
            "id": 1940
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "123"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #6 - A295"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #6 - A295"
              }
            ],
            "repeated": 0,
            "id": 1941
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "123"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #6 - A295"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A295"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #6 - A295"
              }
            ],
            "repeated": 0,
            "id": 1942
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "124"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #7 - A296"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #7 - A296"
              }
            ],
            "repeated": 0,
            "id": 1943
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "124"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #7 - A296"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #7 - A296"
              }
            ],
            "repeated": 0,
            "id": 1944
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "125"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #8 - A297"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #8 - A297"
              }
            ],
            "repeated": 0,
            "id": 1945
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "125"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #8 - A297"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A297"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #8 - A297"
              }
            ],
            "repeated": 0,
            "id": 1946
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "126"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #9 - A298"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #9 - A298"
              }
            ],
            "repeated": 0,
            "id": 1947
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "126"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #9 - A298"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A298"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #9 - A298"
              }
            ],
            "repeated": 0,
            "id": 1948
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "127"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1949
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "127"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Data",
                "value": "PNP0A08"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1950
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "128"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 01"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 01"
              }
            ],
            "repeated": 0,
            "id": 1951
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "128"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 01"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D40"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 01"
              }
            ],
            "repeated": 0,
            "id": 1952
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "129"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 02"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 02"
              }
            ],
            "repeated": 0,
            "id": 1953
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "129"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 02"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D41"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 02"
              }
            ],
            "repeated": 0,
            "id": 1954
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "130"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 03"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 03"
              }
            ],
            "repeated": 0,
            "id": 1955
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "130"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 03"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D42"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 03"
              }
            ],
            "repeated": 0,
            "id": 1956
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "131"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 04"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 04"
              }
            ],
            "repeated": 0,
            "id": 1957
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "131"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 04"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D43"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 04"
              }
            ],
            "repeated": 0,
            "id": 1958
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "132"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 05"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 05"
              }
            ],
            "repeated": 0,
            "id": 1959
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "132"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 05"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 05"
              }
            ],
            "repeated": 0,
            "id": 1960
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "133"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 06"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 06"
              }
            ],
            "repeated": 0,
            "id": 1961
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "133"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 06"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D45"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 06"
              }
            ],
            "repeated": 0,
            "id": 1962
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "134"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 07"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 07"
              }
            ],
            "repeated": 0,
            "id": 1963
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "134"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 07"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D46"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 07"
              }
            ],
            "repeated": 0,
            "id": 1964
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "135"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 08"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 08"
              }
            ],
            "repeated": 0,
            "id": 1965
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "135"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 08"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D47"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 08"
              }
            ],
            "repeated": 0,
            "id": 1966
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "136"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 09"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 09"
              }
            ],
            "repeated": 0,
            "id": 1967
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "136"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 09"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D48"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 09"
              }
            ],
            "repeated": 0,
            "id": 1968
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "137"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 10"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 10"
              }
            ],
            "repeated": 0,
            "id": 1969
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "137"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 10"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D49"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 10"
              }
            ],
            "repeated": 0,
            "id": 1970
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "138"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 11"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 11"
              }
            ],
            "repeated": 0,
            "id": 1971
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "138"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 11"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 11"
              }
            ],
            "repeated": 0,
            "id": 1972
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "139"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 12"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 12"
              }
            ],
            "repeated": 0,
            "id": 1973
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "139"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 12"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 12"
              }
            ],
            "repeated": 0,
            "id": 1974
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "140"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 13"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 13"
              }
            ],
            "repeated": 0,
            "id": 1975
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "140"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 13"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 13"
              }
            ],
            "repeated": 0,
            "id": 1976
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "141"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 14"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 14"
              }
            ],
            "repeated": 0,
            "id": 1977
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "141"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 14"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 14"
              }
            ],
            "repeated": 0,
            "id": 1978
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "142"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 15"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 15"
              }
            ],
            "repeated": 0,
            "id": 1979
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "142"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 15"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 15"
              }
            ],
            "repeated": 0,
            "id": 1980
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "143"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 16"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 16"
              }
            ],
            "repeated": 0,
            "id": 1981
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "143"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 16"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 16"
              }
            ],
            "repeated": 0,
            "id": 1982
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "144"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 17"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 17"
              }
            ],
            "repeated": 0,
            "id": 1983
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "144"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 17"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D50"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 17"
              }
            ],
            "repeated": 0,
            "id": 1984
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "145"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 18"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 18"
              }
            ],
            "repeated": 0,
            "id": 1985
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "145"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 18"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D51"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 18"
              }
            ],
            "repeated": 0,
            "id": 1986
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "146"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 19"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 19"
              }
            ],
            "repeated": 0,
            "id": 1987
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "146"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 19"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D52"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 19"
              }
            ],
            "repeated": 0,
            "id": 1988
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "147"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 20"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 20"
              }
            ],
            "repeated": 0,
            "id": 1989
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "147"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 20"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D53"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 20"
              }
            ],
            "repeated": 0,
            "id": 1990
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "148"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 21"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 21"
              }
            ],
            "repeated": 0,
            "id": 1991
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "148"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 21"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D54"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 21"
              }
            ],
            "repeated": 0,
            "id": 1992
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "149"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 22"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 22"
              }
            ],
            "repeated": 0,
            "id": 1993
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "149"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 22"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D55"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 22"
              }
            ],
            "repeated": 0,
            "id": 1994
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "150"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 23"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 23"
              }
            ],
            "repeated": 0,
            "id": 1995
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "150"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 23"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D56"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 23"
              }
            ],
            "repeated": 0,
            "id": 1996
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "151"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 24"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 24"
              }
            ],
            "repeated": 0,
            "id": 1997
          },
          {
            "timestamp": "2026-05-28 22:32:01,502",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "151"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 24"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D57"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 24"
              }
            ],
            "repeated": 0,
            "id": 1998
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "152"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 25"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 25"
              }
            ],
            "repeated": 0,
            "id": 1999
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "152"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 25"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D58"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 25"
              }
            ],
            "repeated": 0,
            "id": 2000
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "153"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 26"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 26"
              }
            ],
            "repeated": 0,
            "id": 2001
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "153"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 26"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D59"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 26"
              }
            ],
            "repeated": 0,
            "id": 2002
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "154"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 27"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 27"
              }
            ],
            "repeated": 0,
            "id": 2003
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "154"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 27"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 27"
              }
            ],
            "repeated": 0,
            "id": 2004
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "155"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 28"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 28"
              }
            ],
            "repeated": 0,
            "id": 2005
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "155"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 28"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 28"
              }
            ],
            "repeated": 0,
            "id": 2006
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "156"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 29"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 29"
              }
            ],
            "repeated": 0,
            "id": 2007
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "156"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 29"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 29"
              }
            ],
            "repeated": 0,
            "id": 2008
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "157"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 30"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 30"
              }
            ],
            "repeated": 0,
            "id": 2009
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "157"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 30"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 30"
              }
            ],
            "repeated": 0,
            "id": 2010
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "158"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 31"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 31"
              }
            ],
            "repeated": 0,
            "id": 2011
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "158"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 31"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 31"
              }
            ],
            "repeated": 0,
            "id": 2012
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "159"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 32"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 32"
              }
            ],
            "repeated": 0,
            "id": 2013
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "159"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 32"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 32"
              }
            ],
            "repeated": 0,
            "id": 2014
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "160"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 01"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 01"
              }
            ],
            "repeated": 0,
            "id": 2015
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "160"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 01"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 01"
              }
            ],
            "repeated": 0,
            "id": 2016
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "161"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 02"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 02"
              }
            ],
            "repeated": 0,
            "id": 2017
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "161"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 02"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 02"
              }
            ],
            "repeated": 0,
            "id": 2018
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "162"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 03"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 03"
              }
            ],
            "repeated": 0,
            "id": 2019
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "162"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 03"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 03"
              }
            ],
            "repeated": 0,
            "id": 2020
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "163"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 04"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 04"
              }
            ],
            "repeated": 0,
            "id": 2021
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "163"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 04"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 04"
              }
            ],
            "repeated": 0,
            "id": 2022
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "164"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 05"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 05"
              }
            ],
            "repeated": 0,
            "id": 2023
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "164"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 05"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 05"
              }
            ],
            "repeated": 0,
            "id": 2024
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "165"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 06"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 06"
              }
            ],
            "repeated": 0,
            "id": 2025
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "165"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 06"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 06"
              }
            ],
            "repeated": 0,
            "id": 2026
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "166"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 07"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 07"
              }
            ],
            "repeated": 0,
            "id": 2027
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "166"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 07"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 07"
              }
            ],
            "repeated": 0,
            "id": 2028
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "167"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 08"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 08"
              }
            ],
            "repeated": 0,
            "id": 2029
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "167"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 08"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D17"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 08"
              }
            ],
            "repeated": 0,
            "id": 2030
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "168"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 09"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 09"
              }
            ],
            "repeated": 0,
            "id": 2031
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "168"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 09"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D18"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 09"
              }
            ],
            "repeated": 0,
            "id": 2032
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "169"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 10"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 10"
              }
            ],
            "repeated": 0,
            "id": 2033
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "169"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 10"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D19"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 10"
              }
            ],
            "repeated": 0,
            "id": 2034
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "170"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 11"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 11"
              }
            ],
            "repeated": 0,
            "id": 2035
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "170"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 11"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D1A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 11"
              }
            ],
            "repeated": 0,
            "id": 2036
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "171"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 12"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 12"
              }
            ],
            "repeated": 0,
            "id": 2037
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "Index",
                "value": "171"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 12"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D1B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 12"
              }
            ],
            "repeated": 0,
            "id": 2038
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 2039
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 2040
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 2041
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 2042
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "DEVOBJ.dll"
              }
            ],
            "repeated": 0,
            "id": 2043
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devobj.dll"
              }
            ],
            "repeated": 0,
            "id": 2044
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devobj.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2045
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devobj.dll"
              }
            ],
            "repeated": 0,
            "id": 2046
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96050000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00033000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2047
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96080000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2048
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2049
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2050
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2051
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2052
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2053
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2054
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 2055
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2056
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 2057
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\devobj"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96050000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff960575d0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 2058
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2059
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2060
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2061
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0567e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2062
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470803"
              },
              {
                "name": "InBuffer",
                "value": "\\x18\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x19\\x00\\x00\\x00\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x00E\\x007\\x007\\x00A\\x002\\x002\\x007\\x00D\\x00-\\x004\\x00A\\x00C\\x00D\\x00-\\x004\\x000\\x005\\x008\\x00-\\x00B\\x00A\\x006\\x002\\x00-\\x002\\x004\\x00E\\x00E\\x004\\x000\\x008\\x00B\\x00D\\x001\\x00F\\x00D\\x00}\\x00\\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2063
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdc\\x9a\\x13\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2064
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xdd|\\xa2q*\\x81\\xd0\\x11\\xbe\\xc7\\x08\\x00+\\xe2\t/D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2065
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2066
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18eati"
              }
            ],
            "repeated": 0,
            "id": 2067
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2068
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2069
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\xea\\x04"
              }
            ],
            "repeated": 0,
            "id": 2070
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xff\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2071
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\xff"
              }
            ],
            "repeated": 0,
            "id": 2072
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2073
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2074
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00B\\x11"
              }
            ],
            "repeated": 0,
            "id": 2075
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2076
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2077
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\xa9\""
              }
            ],
            "repeated": 0,
            "id": 2078
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x03\\x00\\x00\\x80"
              }
            ],
            "repeated": 0,
            "id": 2079
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18eati"
              }
            ],
            "repeated": 0,
            "id": 2080
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdc\\x00\\x00\\xa9\""
              }
            ],
            "repeated": 0,
            "id": 2081
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00`\\x9e\\xfc6e\\xc4\\xcf\\x11\\x80VDEST\\x00\\x00\\xff\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2082
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\xff"
              }
            ],
            "repeated": 0,
            "id": 2083
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xa0hR}"
              }
            ],
            "repeated": 0,
            "id": 2084
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdcD\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2085
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00k\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2086
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdc\\x00\\x00\\x00\\xff"
              }
            ],
            "repeated": 0,
            "id": 2087
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00o\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2088
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xff\\xff\\xff\\xff"
              }
            ],
            "repeated": 0,
            "id": 2089
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\xff"
              }
            ],
            "repeated": 0,
            "id": 2090
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2091
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xff\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2092
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00h\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xff\\xff\\xff\\xff"
              }
            ],
            "repeated": 0,
            "id": 2093
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x189\\x001\\x00"
              }
            ],
            "repeated": 0,
            "id": 2094
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2095
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2096
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00{\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x184\\x00B\\x00"
              }
            ],
            "repeated": 0,
            "id": 2097
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xa0hR}"
              }
            ],
            "repeated": 0,
            "id": 2098
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00x\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2099
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00r\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2100
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xff\\xff\\xff\\xff"
              }
            ],
            "repeated": 0,
            "id": 2101
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00n\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x16 "
              }
            ],
            "repeated": 0,
            "id": 2102
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xdd|\\xa2q*\\x81\\xd0\\x11\\xbe\\xc7\\x08\\x00+\\xe2\t/D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2103
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00`\\x9e\\xfc6e\\xc4\\xcf\\x11\\x80VDEST\\x00\\x009\\x001\\x00"
              }
            ],
            "repeated": 0,
            "id": 2104
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2105
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00A\\xc7\\xf9bZ\\xb2\\xceF\\xb5L\\x9b\\xcc\\xce\\x08\\xb6\\xf2P\\x0fa\\x05"
              }
            ],
            "repeated": 0,
            "id": 2106
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00f\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18s|OS"
              }
            ],
            "repeated": 0,
            "id": 2107
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00g\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x189\\x001\\x00"
              }
            ],
            "repeated": 0,
            "id": 2108
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x180060"
              }
            ],
            "repeated": 0,
            "id": 2109
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00j\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\"\\x00\\xa2"
              }
            ],
            "repeated": 0,
            "id": 2110
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2111
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\x1a\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2112
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2113
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18P\\x0fa\\x05"
              }
            ],
            "repeated": 0,
            "id": 2114
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0beD\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2115
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0be\\x00\\x00\\xb5\\x1b"
              }
            ],
            "repeated": 0,
            "id": 2116
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0beT\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2117
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0be\\xa8\\x0e\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2118
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0beD\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 2119
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2120
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\xfd\\x14"
              }
            ],
            "repeated": 0,
            "id": 2121
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00e\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xa8\\x0e\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2122
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xdd|\\xa2q*\\x81\\xd0\\x11\\xbe\\xc7\\x08\\x00+\\xe2\t/D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2123
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00A\\xc7\\xf9bZ\\xb2\\xceF\\xb5L\\x9b\\xcc\\xce\\x08\\xb6\\xf2D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2124
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2125
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xff\\xff\\xff\\xff"
              }
            ],
            "repeated": 0,
            "id": 2126
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2127
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2128
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00r\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2129
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xa0\\x17Zt\\xd3t\\xd0\\x11\\xb6\\xfe\\x00\\xa0\\xc9\\x0fW\\xda\\x00\\x00\\xb5\\x1b"
              }
            ],
            "repeated": 0,
            "id": 2130
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdc\\x00\\x00\\xfd\\x14"
              }
            ],
            "repeated": 0,
            "id": 2131
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\"\\x00\\xa2"
              }
            ],
            "repeated": 0,
            "id": 2132
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00o\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x03\\x00\\x00\\x80"
              }
            ],
            "repeated": 0,
            "id": 2133
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe7/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2134
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2135
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2136
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2137
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2138
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2139
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x001\\x003\\x003\\x006\\x001\\x009\\x00e\\x004\\x00-\\x001\\x004\\x003\\x00b\\x00-\\x004\\x006\\x003\\x00a\\x00-\\x00b\\x008\\x000\\x009\\x00-\\x00b\\x001\\x00f\\x005\\x001\\x00d\\x000\\x005\\x00f\\x009\\x007\\x003\\x00}\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00{\\x001\\x003\\x003\\x006\\x001\\x009\\x00e\\x004\\x00-\\x001\\x004\\x003\\x00b\\x00-\\x004\\x006\\x003\\x00a\\x00-\\x00b\\x008\\x000\\x009\\x00-\\x00b\\x001\\x00f\\x005\\x001\\x00d\\x000\\x005\\x00f\\x009\\x007\\x003\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x03\\x80"
              }
            ],
            "repeated": 0,
            "id": 2140
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2141
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2142
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2143
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2144
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2145
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2146
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2147
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2148
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2149
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2150
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2151
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2152
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2153
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2154
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2155
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2156
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2157
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2158
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2159
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernelbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 2160
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetThreadUILanguage"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964ec570"
              }
            ],
            "repeated": 0,
            "id": 2161
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2162
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlCultureNameToLCID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c8b850"
              }
            ],
            "repeated": 0,
            "id": 2163
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetThreadPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c85ca0"
              }
            ],
            "repeated": 0,
            "id": 2164
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de056185a0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2165
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2166
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2167
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetFileMUIPath"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c968f0"
              }
            ],
            "repeated": 0,
            "id": 2168
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2169
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2170
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2171
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2172
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2173
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2174
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2175
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2176
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2177
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2178
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2179
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2180
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2181
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2182
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2183
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2184
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2185
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2186
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2187
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2188
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2189
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2190
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2191
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2192
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2193
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2194
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2195
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2196
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2197
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2198
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2199
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2200
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2201
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2202
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2203
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2204
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2205
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2206
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2207
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2208
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2209
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2210
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2211
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2212
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2213
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2214
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2215
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2216
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2217
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2218
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2219
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2220
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2221
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2222
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2223
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2224
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2225
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2226
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2227
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2228
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2229
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2230
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2231
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2232
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2233
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2234
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2235
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2236
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2237
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2238
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2239
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2240
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2241
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2242
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2243
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2244
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2245
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2246
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2247
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2248
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2249
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2250
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2251
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2252
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2253
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2254
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2255
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2256
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2257
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2258
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2259
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2260
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2261
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2262
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2263
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2264
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2265
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2266
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2267
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2268
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2269
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2270
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2271
          },
          {
            "timestamp": "2026-05-28 22:32:01,518",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2272
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2273
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2274
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2275
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2276
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2277
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2278
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2279
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2280
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2281
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2282
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2283
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2284
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2285
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2286
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2287
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2288
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2289
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2290
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2291
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2292
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2293
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2294
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2295
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2296
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2297
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2298
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2299
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2300
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2301
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2302
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2303
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2304
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2305
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2306
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2307
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2308
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2309
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2310
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2311
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2312
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2313
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2314
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2315
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2316
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2317
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2318
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2319
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2320
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2321
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2322
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2323
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2324
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2325
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2326
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2327
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2328
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2329
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2330
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2331
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2332
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2333
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2334
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2335
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2336
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2337
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2338
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2339
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2340
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2341
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2342
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2343
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2344
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2345
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2346
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2347
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2348
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2349
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2350
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2351
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2352
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2353
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2354
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2355
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2356
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2357
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2358
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2359
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2360
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2361
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2362
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2363
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2364
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2365
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2366
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2367
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2368
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2369
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2370
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2371
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2372
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2373
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2374
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2375
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2376
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2377
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2378
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2379
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2380
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2381
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2382
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2383
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2384
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2385
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2386
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2387
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2388
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2389
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2390
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2391
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2392
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2393
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2394
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2395
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2396
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2397
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2398
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2399
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2400
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2401
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2402
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2403
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2404
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2405
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2406
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2407
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2408
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2409
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2410
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2411
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2412
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2413
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2414
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2415
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2416
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2417
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2418
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2419
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2420
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2421
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2422
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2423
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2424
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2425
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2426
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2427
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2428
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2429
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2430
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2431
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2432
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2433
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2434
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2435
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2436
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2437
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2438
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2439
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2440
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2441
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2442
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2443
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2444
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2445
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2446
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2447
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2448
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2449
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2450
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2451
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2452
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2453
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2454
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2455
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2456
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2457
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2458
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2459
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2460
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2461
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2462
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2463
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2464
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2465
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2466
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2467
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2468
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2469
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2470
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2471
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2472
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2473
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2474
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2475
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2476
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2477
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2478
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2479
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2480
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2481
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2482
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2483
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2484
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2485
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2486
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2487
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2488
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2489
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2490
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2491
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2492
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2493
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2494
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2495
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2496
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2497
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2498
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2499
          },
          {
            "timestamp": "2026-05-28 22:32:01,533",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2500
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2501
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2502
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2503
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2504
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2505
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2506
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2507
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2508
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2509
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2510
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2511
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2512
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2513
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2514
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2515
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2516
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2517
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2518
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2519
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2520
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2521
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2522
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2523
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2524
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2525
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2526
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2527
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2528
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2529
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2530
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2531
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2532
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2533
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2534
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2535
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2536
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2537
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2538
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2539
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2540
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2541
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2542
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2543
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2544
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2545
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2546
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2547
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2548
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2549
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2550
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618660",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2551
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2552
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2553
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2554
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2555
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2556
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2557
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2558
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2559
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2560
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2561
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2562
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2563
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2564
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2565
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2566
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2567
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2568
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2569
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2570
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2571
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2572
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2573
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2574
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de056185a0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2575
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2576
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2577
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2578
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2579
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2580
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2581
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2582
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2583
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2584
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2585
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2586
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2587
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2588
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2589
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2590
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2591
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2592
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2593
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2594
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2595
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2596
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2597
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2598
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2599
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2600
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2601
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2602
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2603
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2604
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2605
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2606
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2607
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2608
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2609
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2610
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2611
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2612
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2613
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2614
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2615
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2616
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2617
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2618
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2619
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2620
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2621
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2622
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de056185a0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2623
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2624
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2625
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2626
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2627
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000474"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2628
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2629
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 2630
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2631
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2632
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2633
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2634
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 2635
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2636
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05679000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2637
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05666000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 2638
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2639
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2640
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2641
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2642
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2643
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2644
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2645
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2646
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2647
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2648
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2649
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2650
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2651
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2652
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2653
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2654
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2655
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2656
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2657
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2658
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2659
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2660
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2661
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2662
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2663
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2664
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2665
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2666
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2667
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2668
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2669
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2670
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2671
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2672
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2673
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2674
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2675
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2676
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2677
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2678
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2679
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2680
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2681
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2682
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2683
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2684
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2685
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2686
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2687
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2688
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2689
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2690
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2691
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2692
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2693
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2694
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2695
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2696
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2697
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2698
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2699
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2700
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2701
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2702
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2703
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2704
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2705
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2706
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2707
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2708
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2709
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2710
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2711
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2712
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2713
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2714
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2715
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2716
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2717
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2718
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2719
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2720
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2721
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2722
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2723
          },
          {
            "timestamp": "2026-05-28 22:32:01,549",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2724
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2725
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2726
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2727
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2728
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2729
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2730
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2731
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2732
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2733
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2734
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2735
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05666000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2736
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2737
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2738
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2739
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2740
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2741
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2742
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2743
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2744
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2745
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2746
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2747
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2748
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2749
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2750
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2751
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2752
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2753
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2754
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2755
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2756
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2757
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2758
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2759
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2760
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2761
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2762
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2763
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2764
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2765
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2766
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2767
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2768
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2769
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2770
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2771
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2772
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2773
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2774
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2775
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2776
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2777
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2778
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2779
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2780
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2781
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2782
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2783
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2784
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2785
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2786
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2787
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2788
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2789
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2790
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2791
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2792
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2793
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2794
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2795
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2796
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2797
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2798
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2799
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de056186c0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2800
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2801
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2802
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2803
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2804
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2805
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2806
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2807
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2808
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2809
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2810
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2811
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2812
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2813
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2814
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2815
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2816
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2817
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2818
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2819
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2820
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2821
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2822
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2823
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2824
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2825
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2826
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 2827
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 2828
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 2829
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2830
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 2831
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2832
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2833
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2834
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2835
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2836
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2837
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x006\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2838
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2839
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc06\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2840
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2841
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2842
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2843
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2844
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2845
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2846
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2847
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xac\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2848
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2849
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x04\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2850
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2851
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x00\\x00\\x00\\x12 \\x00\\x00U\\x00S\\x00B\\x00\\\\x00R\\x00O\\x00O\\x00T\\x00_\\x00H\\x00U\\x00B\\x003\\x000\\x00&\\x00V\\x00I\\x00D\\x001\\x00B\\x003\\x006\\x00&\\x00P\\x00I\\x00D\\x000\\x000\\x000\\x00D\\x00&\\x00R\\x00E\\x00V\\x000\\x000\\x000\\x001\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00R\\x00O\\x00O\\x00T\\x00_\\x00H\\x00U\\x00B\\x003\\x000\\x00&\\x00V\\x00I\\x00D\\x001\\x00B\\x003\\x006\\x00&\\x00P\\x00I\\x00D\\x000\\x000\\x000\\x00D\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00R\\x00O\\x00O\\x00T\\x00_\\x00H\\x00U\\x00B\\x003\\x000\\x00\\x00\\x00\\x00\\x00f\\xed\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2852
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2853
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2854
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2855
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2856
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2857
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2858
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2859
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00B\\x000\\x000\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00B\\x000\\x000\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00B\\x000\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2860
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2861
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2862
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2863
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0R\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2864
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2865
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00V\\x00O\\x00L\\x00M\\x00G\\x00R\\x00\\x00\\x00\\x00\\x00i\\x00.\\x00"
              }
            ],
            "repeated": 0,
            "id": 2866
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2867
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x00\\x00\\x00\\x12 \\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00\\\\x00v\\x00o\\x00l\\x00m\\x00g\\x00r\\x00\\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00\\\\x00v\\x00o\\x00l\\x00m\\x00g\\x00r\\x00\\x00\\x00\\x00\\x00\"\\x97\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2868
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2869
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2870
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2871
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2872
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2873
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x000\\x00f\\x004\\x001\\x003\\x000\\x00d\\x00d\\x00-\\x001\\x009\\x00c\\x007\\x00-\\x007\\x00a\\x00b\\x006\\x00-\\x009\\x009\\x00a\\x001\\x00-\\x009\\x008\\x000\\x00f\\x000\\x003\\x00b\\x002\\x00e\\x00e\\x004\\x00e\\x00}\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00{\\x000\\x00f\\x004\\x001\\x003\\x000\\x00d\\x00d\\x00-\\x001\\x009\\x00c\\x007\\x00-\\x007\\x00a\\x00b\\x006\\x00-\\x009\\x009\\x00a\\x001\\x00-\\x009\\x008\\x000\\x00f\\x000\\x003\\x00b\\x002\\x00e\\x00e\\x004\\x00e\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd00"
              }
            ],
            "repeated": 0,
            "id": 2874
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2875
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2876
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2877
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2878
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2879
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2880
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2881
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x003\\x000\\x003\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x003\\x000\\x003\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x003\\x000\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2882
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2883
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xae\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2884
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2885
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2886
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2887
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00_\\x00s\\x007\\x00d\\x001\\x004\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00_\\x00s\\x007\\x00d\\x001\\x004\\x00\\x00\\x00\\x00\\x00\\x00\\x00P1"
              }
            ],
            "repeated": 0,
            "id": 2888
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2889
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2890
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2891
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2892
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2893
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x04\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2894
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2895
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x01\\x00\\x00\\x12 \\x00\\x00H\\x00I\\x00D\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x000\\x00\\x00\\x00H\\x00I\\x00D\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00\\x00\\x00H\\x00I\\x00D\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00U\\x00P\\x00:\\x000\\x000\\x000\\x001\\x00_\\x00U\\x00:\\x000\\x000\\x000\\x002\\x00\\x00\\x00H\\x00I\\x00D\\x00_\\x00D\\x00E\\x00V\\x00I\\x00C\\x00E\\x00_\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x00_\\x00M\\x00O\\x00U\\x00S\\x00E\\x00\\x00\\x00H\\x00I\\x00D\\x00_\\x00D\\x00E\\x00V\\x00I\\x00C\\x00E\\x00_\\x00U\\x00P\\x00:\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2896
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2897
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2898
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2899
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0&\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2900
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2901
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2902
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2903
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00B\\x00a\\x00s\\x00i\\x00c\\x00D\\x00i\\x00s\\x00p\\x00l\\x00a\\x00y\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2904
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2905
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2906
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2907
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2908
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2909
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00C\\x000\\x001\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x001\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2910
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2911
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0`\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2912
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2913
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2914
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2915
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00Q\\x00E\\x00M\\x00U\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x002\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00Q\\x00E\\x00M\\x00U\\x000\\x000\\x000\\x002\\x00\\x00\\x00*\\x00Q\\x00E\\x00M\\x00U\\x000\\x000\\x000\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2916
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2917
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2918
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2919
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2920
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2921
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00V\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2922
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2923
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2924
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2925
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2926
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2927
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2928
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2929
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2930
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2931
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0&\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2932
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2933
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2934
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2935
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00C\\x00o\\x00m\\x00p\\x00o\\x00s\\x00i\\x00t\\x00e\\x00B\\x00u\\x00s\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2936
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2937
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2938
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2939
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2940
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2941
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00v\\x00d\\x00r\\x00v\\x00r\\x00o\\x00o\\x00t\\x00\\x00\\x00\\x00\\x00P\\x00N\\x00"
              }
            ],
            "repeated": 0,
            "id": 2942
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2943
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2944
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2945
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2946
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2947
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x006\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00\\x00\\x002\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2948
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2949
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2950
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2951
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0^\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2952
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2953
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00R\\x00o\\x00o\\x00t\\x00\\\\x00S\\x00p\\x00a\\x00c\\x00e\\x00p\\x00o\\x00r\\x00t\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 2954
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2955
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00^\\x00\\x00\\x00\\x12 \\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00\\\\x00s\\x00p\\x00a\\x00c\\x00e\\x00p\\x00o\\x00r\\x00t\\x00\\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00\\\\x00s\\x00p\\x00a\\x00c\\x00e\\x00p\\x00o\\x00r\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2956
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2957
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2958
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2959
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2960
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2961
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x006\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2962
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2963
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2964
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2965
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2966
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2967
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x005\\x000\\x001\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x005\\x000\\x001\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x005\\x000\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2968
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2969
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x18\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2970
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2971
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2972
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2973
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x12 \\x00\\x00r\\x00o\\x00o\\x00t\\x00\\\\x00k\\x00d\\x00n\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00r\\x00t\\x00"
              }
            ],
            "repeated": 0,
            "id": 2974
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2975
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0`\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2976
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2977
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2978
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2979
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00A\\x00C\\x00P\\x00I\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x001\\x000\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00A\\x00C\\x00P\\x00I\\x000\\x000\\x001\\x000\\x00\\x00\\x00*\\x00A\\x00C\\x00P\\x00I\\x000\\x000\\x001\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2980
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2981
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x005\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2982
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2983
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc02\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2984
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2985
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2986
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2987
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x002\\x00\\x00\\x00\\x12 \\x00\\x00M\\x00O\\x00N\\x00I\\x00T\\x00O\\x00R\\x00\\\\x00D\\x00e\\x00f\\x00a\\x00u\\x00l\\x00t\\x00_\\x00M\\x00o\\x00n\\x00i\\x00t\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2988
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2989
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x009\\x00F\\x00F\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00"
              }
            ],
            "repeated": 0,
            "id": 2990
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2991
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2992
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2993
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2994
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2995
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 2996
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 2997
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2998
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 2999
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3000
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3001
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x003\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3002
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3003
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x003\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x003\\x00"
              }
            ],
            "repeated": 0,
            "id": 3004
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3005
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x18\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3006
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3007
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3008
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3009
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x12 \\x00\\x00r\\x00o\\x00o\\x00t\\x00\\\\x00u\\x00m\\x00b\\x00u\\x00s\\x00\\x00\\x00\\x00\\x00c\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3010
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3011
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3012
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3013
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3014
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3015
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3016
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3017
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3018
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3019
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3020
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3021
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00a\\x00c\\x00p\\x00i\\x00a\\x00p\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00in"
              }
            ],
            "repeated": 0,
            "id": 3022
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3023
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00\\\\x00A\\x00C\\x00P\\x00I\\x00_\\x00H\\x00A\\x00L\\x00\\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00\\\\x00A\\x00C\\x00P\\x00I\\x00_\\x00H\\x00A\\x00L\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3024
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3025
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3026
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3027
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0(\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3028
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3029
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x01\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00M\\x00Z\\x007\\x006\\x00E\\x001\\x002\\x000\\x002\\x00.\\x005\\x00+\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00M\\x00Z\\x007\\x006\\x00E\\x001\\x002\\x000\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00M\\x00Z\\x007\\x006\\x00E\\x001\\x002\\x000\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 3030
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3031
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00R\\x00A\\x00W\\x00\\x00\\x00\\x00\\x00t\\x00o\\x00"
              }
            ],
            "repeated": 0,
            "id": 3032
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3033
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3034
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3035
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3036
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3037
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x008\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x008\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x008\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3038
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3039
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3040
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3041
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3042
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3043
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3044
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3045
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3046
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3047
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3048
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3049
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc06\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3050
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3051
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3052
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3053
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00_\\x00H\\x00A\\x00L\\x00\\\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x008\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3054
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3055
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1a\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3056
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3057
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x1a\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3058
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3059
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3060
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3061
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3062
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3063
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00B\\x00a\\x00s\\x00i\\x00c\\x00R\\x00e\\x00n\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3064
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3065
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0>\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3066
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3067
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3068
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3069
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00>\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00F\\x00i\\x00x\\x00e\\x00d\\x00B\\x00u\\x00t\\x00t\\x00o\\x00n\\x00\\x00\\x00*\\x00F\\x00i\\x00x\\x00e\\x00d\\x00B\\x00u\\x00t\\x00t\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 3070
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3071
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3072
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3073
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3074
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3075
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3076
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3077
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3078
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3079
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3080
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3081
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3082
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3083
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3084
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3085
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 3086
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3087
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3088
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3089
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3090
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3091
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3092
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3093
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3094
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3095
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3096
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3097
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3098
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3099
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3100
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3101
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 3102
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3103
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3104
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3105
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3106
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3107
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3108
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3109
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 3110
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3111
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3112
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3113
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3114
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3115
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3116
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3117
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 3118
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3119
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3120
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3121
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3122
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3123
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3124
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3125
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3126
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3127
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3128
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3129
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3130
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3131
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3132
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3133
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3134
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3135
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0@\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3136
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3137
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0*\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3138
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3139
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x01\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00_\\x00_\\x00_\\x00_\\x002\\x00.\\x005\\x00+\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00_\\x00_\\x00_\\x00_\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00_\\x00_\\x00"
              }
            ],
            "repeated": 0,
            "id": 3140
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3141
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00R\\x00A\\x00W\\x00\\x00\\x00\\x00\\x00o\\x00r\\x00"
              }
            ],
            "repeated": 0,
            "id": 3142
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3143
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3144
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3145
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3146
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3147
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 3148
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3149
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3150
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3151
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3152
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3153
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00n\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3154
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3155
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3156
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3157
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3158
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3159
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3160
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3161
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3162
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3163
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0*\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3164
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3165
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3166
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3167
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00N\\x00d\\x00i\\x00s\\x00V\\x00i\\x00r\\x00t\\x00u\\x00a\\x00l\\x00B\\x00u\\x00s\\x00\\x00\\x00\\x00\\x00o\\x00r\\x00"
              }
            ],
            "repeated": 0,
            "id": 3168
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3169
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3170
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3171
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3172
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3173
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3174
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3175
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3176
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3177
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0b\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3178
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00m\\x00a\\x00c\\x00h\\x00i\\x00n\\x00e\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00l\\x00p\\x00c\\x00c\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00_\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00L\\x00P\\x00C\\x00 \\x00C\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3179
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x495fe23f"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 3180
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3181
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 3182
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 3183
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de056185a0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaaded80c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 3184
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3185
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3186
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x02\\x00\\x00\\x00\\x00\\x00|Y\\x02\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3187
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              }
            ],
            "repeated": 0,
            "id": 3188
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00026000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3189
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3190
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 3191
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 3192
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 3193
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00026000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3194
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 3195
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3196
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3197
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0b\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3198
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00m\\x00a\\x00c\\x00h\\x00i\\x00n\\x00e\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00l\\x00p\\x00c\\x00c\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00_\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00L\\x00P\\x00C\\x00 \\x00C\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3199
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de05618480",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x495fe23f"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 3200
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3201
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 3202
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 3203
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x1de056186c0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaaded80c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 3204
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3205
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3206
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x02\\x00\\x00\\x00\\x00\\x00|Y\\x02\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3207
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000480"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              }
            ],
            "repeated": 0,
            "id": 3208
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9d412fd390"
              },
              {
                "name": "ViewSize",
                "value": "0x00026000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3209
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3210
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 2,
            "id": 3211
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 3212
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 3213
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00026000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3214
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 3215
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3216
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3217
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3218
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3219
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3220
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3221
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00m\\x00s\\x00s\\x00m\\x00b\\x00i\\x00o\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00N\\x00"
              }
            ],
            "repeated": 0,
            "id": 3222
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3223
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3224
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3225
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3226
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3227
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x008\\x000\\x008\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3228
          },
          {
            "timestamp": "2026-05-28 22:32:01,565",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3229
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3230
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3231
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0l\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3232
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3233
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x90\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3234
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3235
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x12 \\x00\\x00U\\x00S\\x00B\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x000\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3236
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3237
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\x00\\x00\\x12 \\x00\\x00U\\x00S\\x00B\\x00\\\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x003\\x00&\\x00S\\x00u\\x00b\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x000\\x00&\\x00P\\x00r\\x00o\\x00t\\x00_\\x000\\x000\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x003\\x00&\\x00S\\x00u\\x00b\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x000\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x003\\x00\\x00\\x00\\x00\\x00M\\x003\\x00"
              }
            ],
            "repeated": 0,
            "id": 3238
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3239
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3240
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3241
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3242
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3243
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x000\\x008\\x004\\x00f\\x000\\x001\\x00f\\x00a\\x00-\\x00e\\x006\\x003\\x004\\x00-\\x004\\x00d\\x007\\x007\\x00-\\x008\\x003\\x00e\\x00e\\x00-\\x000\\x007\\x004\\x008\\x001\\x007\\x00c\\x000\\x003\\x005\\x008\\x001\\x00}\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00{\\x000\\x008\\x004\\x00f\\x000\\x001\\x00f\\x00a\\x00-\\x00e\\x006\\x003\\x004\\x00-\\x004\\x00d\\x007\\x007\\x00-\\x008\\x003\\x00e\\x00e\\x00-\\x000\\x007\\x004\\x008\\x001\\x007\\x00c\\x000\\x003\\x005\\x008\\x001\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xe9"
              }
            ],
            "repeated": 0,
            "id": 3244
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3245
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3246
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3247
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3248
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3249
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3250
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3251
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00S\\x00W\\x00E\\x00N\\x00U\\x00M\\x00\\x00\\x00\\x00\\x003\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 3252
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3253
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3254
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3255
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3256
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3257
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00F\\x001\\x003\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00F\\x001\\x003\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00F\\x001\\x003\\x00\\x00\\x00\\x00\\x00_\\x00l\\x00"
              }
            ],
            "repeated": 0,
            "id": 3258
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3259
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3260
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3261
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3262
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3263
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000210"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xeb/A\\x9d\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00R\\x00D\\x00P\\x00B\\x00U\\x00S\\x00\\x00\\x00\\x00\\x00e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3264
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 1,
            "id": 3265
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 3266
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HstiDmaLogged"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged"
              }
            ],
            "repeated": 0,
            "id": 3267
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05679000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3268
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3269
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3270
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3271
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software"
              }
            ],
            "repeated": 0,
            "id": 3272
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System"
              }
            ],
            "repeated": 0,
            "id": 3273
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 3274
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 3275
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 3276
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3277
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000044c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 3278
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3279
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3280
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3281
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3282
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3283
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3284
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000488"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "imagehlp.dll"
              }
            ],
            "repeated": 0,
            "id": 3285
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000488"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001d000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3286
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98577000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3287
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3288
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3289
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3290
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3291
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3292
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 3293
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 3294
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3295
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3296
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3297
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 3298
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 3299
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\imagehlp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff985623b0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3300
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\tbs"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8e465fa0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3301
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3302
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3303
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0000000",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE"
              },
              {
                "name": "FileName",
                "value": "\\??\\TPM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 3304
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": false,
            "return": "0xffffffffc0000008",
            "pretty_return": "INVALID_HANDLE",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3305
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05670000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3306
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3307
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 3308
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3309
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 3310
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3311
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae3da6",
            "parentcaller": "0x7ff726ae46e0",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#60"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 3,
            "id": 3312
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae3db9",
            "parentcaller": "0x7ff726ae474b",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c60",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#61"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3313
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae47e7",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "NgscbCheckPreventDeviceEncryption"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8d9070"
              }
            ],
            "repeated": 0,
            "id": 3314
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40a1",
            "parentcaller": "0x7ff726ae480d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "NgscbCheckPreventDeviceEncryptionForAad"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8d9130"
              }
            ],
            "repeated": 0,
            "id": 3315
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3316
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3317
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              }
            ],
            "repeated": 0,
            "id": 3318
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "PreventDeviceEncryption"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryption"
              }
            ],
            "repeated": 0,
            "id": 3319
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3320
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3321
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3322
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              }
            ],
            "repeated": 0,
            "id": 3323
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "PreventDeviceEncryptionForAzureADJoinedDevices"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryptionForAzureADJoinedDevices"
              }
            ],
            "repeated": 0,
            "id": 3324
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3325
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4826",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "NgscbGetWinReConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8da9e0"
              }
            ],
            "repeated": 0,
            "id": 3326
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\reinfo"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 3327
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "reinfo.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 3328
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7fb70000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "reinfo.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 3329
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "reinfo.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7fb70000"
              },
              {
                "name": "FunctionName",
                "value": "WinReGetConfig"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7fb71010"
              }
            ],
            "repeated": 0,
            "id": 3330
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 1,
            "id": 3331
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3332
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3333
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00]\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3334
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff<?xml version='1.0' encoding='utf-8'?>\n\r\n<WindowsRE version=\"2.0\">\r\n  <WinreBCD id=\"{268468c0-5aec-11f1-ab56-c28492c2c606}\"/>\r\n  <WinreLocation path=\"\\Recovery\\WindowsRE\" id=\"1384910895\" offset=\"63849889792\" guid=\"{00000000-0000-0000-0000-000000000000}\""
              },
              {
                "name": "Length",
                "value": "1117"
              }
            ],
            "repeated": 0,
            "id": 3335
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3336
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a871000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3337
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05670000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3338
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05670000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3339
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05661000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3340
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05681000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3341
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05681000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3342
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05670000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3343
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0a874000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3344
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3345
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3346
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xe6\\x03\\x00\\x00\\x06\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3347
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xe6\\x03\\x00\\x00\\x06\\x00\\x00\\x00\\xd2\\x00\\x00\\x00`\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xa4\\x00\\x00\\x00.\\x00\\x00\\x00l\\x01\\x00\\x00\\x1c\\x00\\x00\\x002\\x01\\x00\\x00\\x0c\\x00\\x00\\x00>\\x01\\x00\\x00.\\x00\\x00\\x00\\x88\\x01\\x00\\x00`\\x00\\x00\\x002\\x01\\x00\\x00\\x0c\\x00\\x00\\x00>\\x01\\x00\\x00.\\x00\\x00\\x00\"\\x02\\x00\\x00`\\x00\\x00\\x00\\xe8\\x01\\x00\\x00\\x0c\\x00\\x00\\x00\\xf4\\x01\\x00\\x00.\\x00\\x00\\x00j\\x03\\x00\\x00\\x1c\\x00\\x00\\x00\\x82\\x02\\x00\\x00\\xcc\\x00\\x00\\x00N\\x03\\x00\\x00\\x1c\\x00\\x00\\x00\\x86\\x03\\x00\\x00`\\x00\\x00\\x00\\x82\\x02\\x00\\x00\\xcc\\x00\\x00\\x00N\\x03\\x00\\x00\\x1c\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x001\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3348
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3349
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-100000000000}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3350
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3351
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3352
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-100000000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3353
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1400",
                "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY"
              },
              {
                "name": "InBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xd8/A"
              },
              {
                "name": "OutBuffer",
                "value": " \\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00!\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x0b\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3354
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00560000",
                "pretty_value": "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3355
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070048"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3356
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3357
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3358
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\\\x9c~\\x7f\\xed\\x00\\x00P1^\\x05\\xde\\x01\\x00\\x00`VY\\x05\\xde\\x01\\x00\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\xb0\\xd5`\\x05\\xde\\x01\\x00\\x00\\x03\\x00\\x00\\x03b\\xed\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3359
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00/\\x10\\x8cR\\xe2\\xd3\\xc3\\xcf\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3360
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3361
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00090064"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "R\\xbd\\xbb\\x88\\xda\\xbb\\x88\\x90\\xff\\x8f\\x01\\x00\\x00\\x00\\x00\\x00\\xff1\\x00\\x00\\x00\\x00\\x00\\x00\\xa5\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\xaa\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3362
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3363
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3364
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3365
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3366
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3367
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1400",
                "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY"
              },
              {
                "name": "InBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xd8/A"
              },
              {
                "name": "OutBuffer",
                "value": " \\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00!\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x0b\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3368
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00560000",
                "pretty_value": "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3369
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070048"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3370
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3371
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3372
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\\\x9c~\\x7f\\xed\\x00\\x00P1^\\x05\\xde\\x01\\x00\\x00`VY\\x05\\xde\\x01\\x00\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\xb0\\xd5`\\x05\\xde\\x01\\x00\\x00\\x03\\x00\\x00\\x03b\\xed\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3373
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00/\\x10\\x8cR\\xe2\\xd3\\xc3\\xcf\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3374
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3375
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00090064"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "&\\x00\\xbc\\x12>\\xbc\\x12\\xfc\\x9dAm\\x07\\x00\\x00\\x00\\x003\\xa8\\xed\\x00\\x00\\x00\\x00\\x00\\x06\\xc3\\xa3\\x00\\x00\\x00\\x00\\x00h/\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x8a\\x0c\\x00\\x00\\x00\\x00\\x00 \\xc8\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3376
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3377
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3378
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3379
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3380
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3381
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1400",
                "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY"
              },
              {
                "name": "InBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xd8/A"
              },
              {
                "name": "OutBuffer",
                "value": " \\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00!\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x0b\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3382
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00560000",
                "pretty_value": "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3383
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070048"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x01\\x00\\x00\\xe0n\\x07/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3384
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3385
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3386
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\\\x9c~\\x7f\\xed\\x00\\x00P1^\\x05\\xde\\x01\\x00\\x00`VY\\x05\\xde\\x01\\x00\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\xb0\\xd5`\\x05\\xde\\x01\\x00\\x00\\x03\\x00\\x00\\x03b\\xed\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3387
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00/\\x10\\x8cR\\xe2\\xd3\\xc3\\xcf\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3388
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3389
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x00090064"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x9d\\x7f\\xd7`\\x8e\\xd7`\\xca\\xff\\x0f\\x11\\x00\\x00\\x00\\x00\\x00\\xff!\\x02\\x00\\x00\\x00\\x00\\x00\\xdcU\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xb6\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xb6\\x00\\x00\\x00\\x00\\x00\\x00@\\xfa\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3390
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3391
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3392
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3393
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3394
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              }
            ],
            "repeated": 0,
            "id": 3395
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Recovery\\Winre.wim"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3396
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE"
              }
            ],
            "repeated": 0,
            "id": 3397
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "WimValidated"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimValidated"
              }
            ],
            "repeated": 0,
            "id": 3398
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "WimHash"
              },
              {
                "name": "Data",
                "value": "\\x01\\xec\\xce\\xdbE\\xdb\\x11\\x90\\x19\\x0cS\\x1b\\xbb\r\\\\x7f\\xba\\xdd\\xc7\\xdc\\x1b\\xf06\\xaa\\x06\\xc3\\xaa'\\x9b\\xe1~\\xea"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimHash"
              }
            ],
            "repeated": 0,
            "id": 3399
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3400
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05661000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3401
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\reinfo"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 3402
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fb70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3403
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3404
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3405
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xb0\\xe7/A\\x9d\\x00\\x00\\x00\\xe0\\xe7/A\\x9d\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xffg\\x80&z\\xc1,\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00@\\xe5a\\x05\\xde\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe8/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe8/A\\x9d\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00z\\x00~\\x00\\x00\\x00\\x00\\x00@\\xe5a\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xe7/A\\x9d\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3406
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3407
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3408
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3409
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3410
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x8f\\xcb\\x98\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xeb/A\\x9d\\x00\\x00\\x00\\x10@\\x00\\x00\\x00\\x00\\x00\\x00X\\xeb/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x12\\x00'\\x00\\x00\\x00\\x002oY\\x05\\xde\\x01\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x12\\x00'\\x00\\x00\\x00\\x00P\\x82\\xd7\\x98\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x02\\x10\\x00\\x12\\x00\\x00\\x00\\x00=\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xbd\\xc6\\x98\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x12\\x00'\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00=\\x00\\x00\\x005\\x12\\x00'z\\x00\\x00\\x00=\\x00\\x00\\x004\\x00\\x00\\x00\\xff\\x03\\x00\\xfc\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3411
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3412
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3413
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xec/A\\x9d\\x00\\x00\\x00z\\x00|\\x00\\x00\\x00\\x00\\x00\\x17\\x8d&z\\xc1,\\x00\\x00\\x90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xed/A\\x9d\\x00\\x00\\x00@\\xdfe\\x05\\xde\\x01\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00)\\xed/A\\x9d\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00pP\\x96\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00|\\x00|\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x00~\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3414
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3415
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3416
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3417
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xb0\\xe7/A\\x9d\\x00\\x00\\x00\\xe0\\xe7/A\\x9d\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xffg\\x80&z\\xc1,\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00\\x90\\x90_\\x05\\xde\\x01\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe8/A\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xe8/A\\x9d\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x00j\\x00\\x00\\x00\\x00\\x00\\x90\\x90_\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xe7/A\\x9d\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3418
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3419
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3420
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3421
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3422
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3423
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3424
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3425
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xec/A\\x9d\\x00\\x00\\x00z\\x00|\\x00\\x00\\x00\\x00\\x00\\x17\\x8d&z\\xc1,\\x00\\x00\\x90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xed/A\\x9d\\x00\\x00\\x00@\\xdfe\\x05\\xde\\x01\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00)\\xed/A\\x9d\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00pP\\x96\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x01\\x00\\x00\\x00W\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00h\\x00j\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xe7`\\x05\\xde\\x01\\x00\\x00h\\x00j\\x00\\x00\\x00\\x00\\x00\\x10\\xe7`\\x05\\xde\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3426
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3427
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3428
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3429
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3430
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3431
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00"
              }
            ],
            "repeated": 0,
            "id": 3432
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3433
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3434
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xba\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3435
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xba\\x00\\x00\\x00\\x01\\x00\\x00\\x00Z\\x00\\x00\\x00`\\x00\\x00\\x00 \\x00\\x00\\x00\\x0c\\x00\\x00\\x00,\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 3436
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3437
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae447e",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveGetStatusW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8a28f0"
              }
            ],
            "repeated": 0,
            "id": 3438
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3439
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3440
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3441
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610d4"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x10\\x00\"\\x00\\x10\\x00\\x12\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x003\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3442
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3443
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\3\\SEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3444
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\3\\HEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3445
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\GLOBALROOT\\device\\harddisk0\\partition3\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3446
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000424"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3447
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000424"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3448
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 3449
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00&4\\x96\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3450
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3451
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000450"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3452
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 3453
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561083"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb9\\xf0v\\xcd\\xf1\\xee\\xdc\\x01,\\x00\\x08\\x00\n\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x82ud\\xbdW\\xff\\x8f65\\x08=\\x9a\\x02\\xc4\\xb5\\xe2$\\xc1\\x05*\\xf9\\xba5o\\xd5U{7\\xb2\\xb6,\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3454
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3455
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000450"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3456
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 3457
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000448"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00&4\\x96\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3458
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3459
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000450"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3460
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 3461
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3462
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 3463
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48a9",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveCheckTpmCapability"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8a3b80"
              }
            ],
            "repeated": 0,
            "id": 3464
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48be",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "90"
              }
            ],
            "repeated": 0,
            "id": 3465
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48be",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0000000",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE"
              },
              {
                "name": "FileName",
                "value": "\\??\\TPM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3466
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48be",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": false,
            "return": "0xffffffffc0000008",
            "pretty_return": "INVALID_HANDLE",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3467
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae3db9",
            "parentcaller": "0x7ff726ae48e1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70c50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#60"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3468
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 3469
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 3470
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3471
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3472
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3473
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 3474
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3475
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3476
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 3477
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96050000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3478
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3479
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3480
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3481
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 3482
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 3483
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3484
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3485
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3486
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT HypervisorPresent FROM Win32_ComputerSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 3487
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3488
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3489
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3490
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3491
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3492
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 3493
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3494
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 3495
          },
          {
            "timestamp": "2026-05-28 22:32:01,580",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3496
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3497
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3498
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3499
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3500
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3501
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3502
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HypervisorPresent"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 3503
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae6036",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3504
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3505
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726adaa90",
            "parentcaller": "0x00000000",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x001704b6"
              },
              {
                "name": "Message",
                "value": "0x00000401"
              }
            ],
            "repeated": 0,
            "id": 3506
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "2864",
            "caller": "0x7ff726adaab3",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3507
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3508
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "7460",
            "caller": "0x7ff726aecedb",
            "parentcaller": "0x7ff726af0287",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#28"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3509
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "7460",
            "caller": "0x7ff726aee88a",
            "parentcaller": "0x7ff726aea557",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#24"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3510
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "7460",
            "caller": "0x7ff726aed76b",
            "parentcaller": "0x7ff726aed8dc",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 3511
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "7460",
            "caller": "0x7ff726aee88a",
            "parentcaller": "0x7ff726aed0f8",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1de06e70b10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#24"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3512
          },
          {
            "timestamp": "2026-05-28 22:32:01,596",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 10,
            "id": 3513
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 3514
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000104e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3515
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xe8\\xcd@\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xde\\x01\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xe8\\xba3\\x93\\xff\\x7f\\x00\\x00\\xf0\\x916\\x93\\xff\\x7f\\x00\\x00p\\xce3\\x93\\xff\\x7f\\x00\\x00\\x18\\xed\\xcd@\\x9d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3516
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000424"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3517
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000424"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\CTF\\DirectSwitchHotkeys"
              },
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys"
              }
            ],
            "repeated": 0,
            "id": 3518
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 3519
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\CTF\\DirectSwitchHotkeys\\"
              }
            ],
            "repeated": 0,
            "id": 3520
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3521
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x9d40cdeda0"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 3522
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000105c0"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 3523
          },
          {
            "timestamp": "2026-05-28 22:32:03,846",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 29,
            "id": 3524
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "612"
              },
              {
                "name": "y",
                "value": "910"
              }
            ],
            "repeated": 0,
            "id": 3525
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3526
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "612"
              },
              {
                "name": "y",
                "value": "910"
              }
            ],
            "repeated": 1,
            "id": 3527
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "617"
              },
              {
                "name": "y",
                "value": "909"
              }
            ],
            "repeated": 0,
            "id": 3528
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3529
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "617"
              },
              {
                "name": "y",
                "value": "909"
              }
            ],
            "repeated": 0,
            "id": 3530
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "622"
              },
              {
                "name": "y",
                "value": "908"
              }
            ],
            "repeated": 0,
            "id": 3531
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3532
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "622"
              },
              {
                "name": "y",
                "value": "908"
              }
            ],
            "repeated": 0,
            "id": 3533
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "626"
              },
              {
                "name": "y",
                "value": "906"
              }
            ],
            "repeated": 0,
            "id": 3534
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3535
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "626"
              },
              {
                "name": "y",
                "value": "906"
              }
            ],
            "repeated": 0,
            "id": 3536
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "631"
              },
              {
                "name": "y",
                "value": "905"
              }
            ],
            "repeated": 0,
            "id": 3537
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3538
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "631"
              },
              {
                "name": "y",
                "value": "905"
              }
            ],
            "repeated": 0,
            "id": 3539
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "636"
              },
              {
                "name": "y",
                "value": "904"
              }
            ],
            "repeated": 0,
            "id": 3540
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3541
          },
          {
            "timestamp": "2026-05-28 22:32:04,299",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "636"
              },
              {
                "name": "y",
                "value": "904"
              }
            ],
            "repeated": 0,
            "id": 3542
          },
          {
            "timestamp": "2026-05-28 22:32:04,315",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "640"
              },
              {
                "name": "y",
                "value": "903"
              }
            ],
            "repeated": 0,
            "id": 3543
          },
          {
            "timestamp": "2026-05-28 22:32:04,315",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3544
          },
          {
            "timestamp": "2026-05-28 22:32:04,315",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "640"
              },
              {
                "name": "y",
                "value": "903"
              }
            ],
            "repeated": 0,
            "id": 3545
          },
          {
            "timestamp": "2026-05-28 22:32:04,315",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "644"
              },
              {
                "name": "y",
                "value": "902"
              }
            ],
            "repeated": 0,
            "id": 3546
          },
          {
            "timestamp": "2026-05-28 22:32:04,315",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3547
          },
          {
            "timestamp": "2026-05-28 22:32:04,315",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "644"
              },
              {
                "name": "y",
                "value": "902"
              }
            ],
            "repeated": 0,
            "id": 3548
          },
          {
            "timestamp": "2026-05-28 22:32:04,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3549
          },
          {
            "timestamp": "2026-05-28 22:32:04,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "677"
              },
              {
                "name": "y",
                "value": "888"
              }
            ],
            "repeated": 0,
            "id": 3550
          },
          {
            "timestamp": "2026-05-28 22:32:04,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 50,
            "id": 3551
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "651"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3552
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 3553
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "649"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3554
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3555
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "649"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 1,
            "id": 3556
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "644"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3557
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3558
          },
          {
            "timestamp": "2026-05-28 22:32:04,862",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "644"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3559
          },
          {
            "timestamp": "2026-05-28 22:32:04,908",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "614"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3560
          },
          {
            "timestamp": "2026-05-28 22:32:04,908",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3561
          },
          {
            "timestamp": "2026-05-28 22:32:04,908",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "614"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 1,
            "id": 3562
          },
          {
            "timestamp": "2026-05-28 22:32:04,908",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3563
          },
          {
            "timestamp": "2026-05-28 22:32:04,908",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "614"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3564
          },
          {
            "timestamp": "2026-05-28 22:32:04,940",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "600"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3565
          },
          {
            "timestamp": "2026-05-28 22:32:04,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3566
          },
          {
            "timestamp": "2026-05-28 22:32:04,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "600"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 1,
            "id": 3567
          },
          {
            "timestamp": "2026-05-28 22:32:04,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3568
          },
          {
            "timestamp": "2026-05-28 22:32:04,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "600"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3569
          },
          {
            "timestamp": "2026-05-28 22:32:04,955",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "599"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3570
          },
          {
            "timestamp": "2026-05-28 22:32:04,955",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3571
          },
          {
            "timestamp": "2026-05-28 22:32:04,955",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "599"
              },
              {
                "name": "y",
                "value": "723"
              }
            ],
            "repeated": 0,
            "id": 3572
          },
          {
            "timestamp": "2026-05-28 22:32:04,955",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "598"
              },
              {
                "name": "y",
                "value": "724"
              }
            ],
            "repeated": 0,
            "id": 3573
          },
          {
            "timestamp": "2026-05-28 22:32:04,955",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3574
          },
          {
            "timestamp": "2026-05-28 22:32:04,955",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "598"
              },
              {
                "name": "y",
                "value": "724"
              }
            ],
            "repeated": 0,
            "id": 3575
          },
          {
            "timestamp": "2026-05-28 22:32:04,971",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "597"
              },
              {
                "name": "y",
                "value": "724"
              }
            ],
            "repeated": 0,
            "id": 3576
          },
          {
            "timestamp": "2026-05-28 22:32:04,971",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3577
          },
          {
            "timestamp": "2026-05-28 22:32:04,971",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "597"
              },
              {
                "name": "y",
                "value": "724"
              }
            ],
            "repeated": 0,
            "id": 3578
          },
          {
            "timestamp": "2026-05-28 22:32:05,018",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "725"
              }
            ],
            "repeated": 0,
            "id": 3579
          },
          {
            "timestamp": "2026-05-28 22:32:05,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3580
          },
          {
            "timestamp": "2026-05-28 22:32:05,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "725"
              }
            ],
            "repeated": 0,
            "id": 3581
          },
          {
            "timestamp": "2026-05-28 22:32:05,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3582
          },
          {
            "timestamp": "2026-05-28 22:32:05,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05ad",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001016"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3583
          },
          {
            "timestamp": "2026-05-28 22:32:05,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05ad",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001018"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3584
          },
          {
            "timestamp": "2026-05-28 22:32:05,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05ad",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "725"
              }
            ],
            "repeated": 0,
            "id": 3585
          },
          {
            "timestamp": "2026-05-28 22:32:05,393",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "726"
              }
            ],
            "repeated": 0,
            "id": 3586
          },
          {
            "timestamp": "2026-05-28 22:32:05,393",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3587
          },
          {
            "timestamp": "2026-05-28 22:32:05,393",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "726"
              }
            ],
            "repeated": 0,
            "id": 3588
          },
          {
            "timestamp": "2026-05-28 22:32:05,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 3589
          },
          {
            "timestamp": "2026-05-28 22:32:05,862",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "725"
              }
            ],
            "repeated": 0,
            "id": 3590
          },
          {
            "timestamp": "2026-05-28 22:32:05,862",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3591
          },
          {
            "timestamp": "2026-05-28 22:32:05,862",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "725"
              }
            ],
            "repeated": 0,
            "id": 3592
          },
          {
            "timestamp": "2026-05-28 22:32:05,893",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "724"
              }
            ],
            "repeated": 0,
            "id": 3593
          },
          {
            "timestamp": "2026-05-28 22:32:05,893",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3594
          },
          {
            "timestamp": "2026-05-28 22:32:05,893",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "594"
              },
              {
                "name": "y",
                "value": "724"
              }
            ],
            "repeated": 0,
            "id": 3595
          },
          {
            "timestamp": "2026-05-28 22:32:05,893",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "591"
              },
              {
                "name": "y",
                "value": "717"
              }
            ],
            "repeated": 0,
            "id": 3596
          },
          {
            "timestamp": "2026-05-28 22:32:05,893",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3597
          },
          {
            "timestamp": "2026-05-28 22:32:05,893",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "591"
              },
              {
                "name": "y",
                "value": "717"
              }
            ],
            "repeated": 0,
            "id": 3598
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3599
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "589"
              },
              {
                "name": "y",
                "value": "715"
              }
            ],
            "repeated": 0,
            "id": 3600
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3601
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "589"
              },
              {
                "name": "y",
                "value": "715"
              }
            ],
            "repeated": 0,
            "id": 3602
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "569"
              },
              {
                "name": "y",
                "value": "697"
              }
            ],
            "repeated": 0,
            "id": 3603
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3604
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "569"
              },
              {
                "name": "y",
                "value": "697"
              }
            ],
            "repeated": 0,
            "id": 3605
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "567"
              },
              {
                "name": "y",
                "value": "696"
              }
            ],
            "repeated": 0,
            "id": 3606
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3607
          },
          {
            "timestamp": "2026-05-28 22:32:05,940",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "567"
              },
              {
                "name": "y",
                "value": "696"
              }
            ],
            "repeated": 0,
            "id": 3608
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "565"
              },
              {
                "name": "y",
                "value": "694"
              }
            ],
            "repeated": 0,
            "id": 3609
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3610
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "562"
              },
              {
                "name": "y",
                "value": "693"
              }
            ],
            "repeated": 1,
            "id": 3611
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3612
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "562"
              },
              {
                "name": "y",
                "value": "693"
              }
            ],
            "repeated": 0,
            "id": 3613
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "543"
              },
              {
                "name": "y",
                "value": "683"
              }
            ],
            "repeated": 0,
            "id": 3614
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3615
          },
          {
            "timestamp": "2026-05-28 22:32:05,987",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "543"
              },
              {
                "name": "y",
                "value": "683"
              }
            ],
            "repeated": 0,
            "id": 3616
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "496"
              },
              {
                "name": "y",
                "value": "663"
              }
            ],
            "repeated": 0,
            "id": 3617
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3618
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "496"
              },
              {
                "name": "y",
                "value": "663"
              }
            ],
            "repeated": 1,
            "id": 3619
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3620
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "496"
              },
              {
                "name": "y",
                "value": "663"
              }
            ],
            "repeated": 0,
            "id": 3621
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "490"
              },
              {
                "name": "y",
                "value": "661"
              }
            ],
            "repeated": 0,
            "id": 3622
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3623
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "490"
              },
              {
                "name": "y",
                "value": "661"
              }
            ],
            "repeated": 0,
            "id": 3624
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "485"
              },
              {
                "name": "y",
                "value": "659"
              }
            ],
            "repeated": 0,
            "id": 3625
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3626
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "485"
              },
              {
                "name": "y",
                "value": "659"
              }
            ],
            "repeated": 0,
            "id": 3627
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "478"
              },
              {
                "name": "y",
                "value": "657"
              }
            ],
            "repeated": 0,
            "id": 3628
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3629
          },
          {
            "timestamp": "2026-05-28 22:32:06,018",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "478"
              },
              {
                "name": "y",
                "value": "657"
              }
            ],
            "repeated": 0,
            "id": 3630
          },
          {
            "timestamp": "2026-05-28 22:32:06,049",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3631
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "465"
              },
              {
                "name": "y",
                "value": "652"
              }
            ],
            "repeated": 0,
            "id": 3632
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3633
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "465"
              },
              {
                "name": "y",
                "value": "652"
              }
            ],
            "repeated": 1,
            "id": 3634
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3635
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "465"
              },
              {
                "name": "y",
                "value": "652"
              }
            ],
            "repeated": 0,
            "id": 3636
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "415"
              },
              {
                "name": "y",
                "value": "638"
              }
            ],
            "repeated": 0,
            "id": 3637
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3638
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "415"
              },
              {
                "name": "y",
                "value": "638"
              }
            ],
            "repeated": 0,
            "id": 3639
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "411"
              },
              {
                "name": "y",
                "value": "636"
              }
            ],
            "repeated": 0,
            "id": 3640
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3641
          },
          {
            "timestamp": "2026-05-28 22:32:06,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "411"
              },
              {
                "name": "y",
                "value": "636"
              }
            ],
            "repeated": 0,
            "id": 3642
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "355"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3643
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3644
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "355"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 1,
            "id": 3645
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3646
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "355"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3647
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "351"
              },
              {
                "name": "y",
                "value": "619"
              }
            ],
            "repeated": 0,
            "id": 3648
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3649
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "351"
              },
              {
                "name": "y",
                "value": "619"
              }
            ],
            "repeated": 0,
            "id": 3650
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "344"
              },
              {
                "name": "y",
                "value": "617"
              }
            ],
            "repeated": 0,
            "id": 3651
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3652
          },
          {
            "timestamp": "2026-05-28 22:32:06,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "344"
              },
              {
                "name": "y",
                "value": "617"
              }
            ],
            "repeated": 0,
            "id": 3653
          },
          {
            "timestamp": "2026-05-28 22:32:06,143",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "341"
              },
              {
                "name": "y",
                "value": "616"
              }
            ],
            "repeated": 0,
            "id": 3654
          },
          {
            "timestamp": "2026-05-28 22:32:06,143",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3655
          },
          {
            "timestamp": "2026-05-28 22:32:06,143",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "341"
              },
              {
                "name": "y",
                "value": "616"
              }
            ],
            "repeated": 0,
            "id": 3656
          },
          {
            "timestamp": "2026-05-28 22:32:06,143",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "319"
              },
              {
                "name": "y",
                "value": "610"
              }
            ],
            "repeated": 0,
            "id": 3657
          },
          {
            "timestamp": "2026-05-28 22:32:06,143",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3658
          },
          {
            "timestamp": "2026-05-28 22:32:06,143",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "319"
              },
              {
                "name": "y",
                "value": "610"
              }
            ],
            "repeated": 0,
            "id": 3659
          },
          {
            "timestamp": "2026-05-28 22:32:06,158",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3660
          },
          {
            "timestamp": "2026-05-28 22:32:06,174",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "316"
              },
              {
                "name": "y",
                "value": "608"
              }
            ],
            "repeated": 0,
            "id": 3661
          },
          {
            "timestamp": "2026-05-28 22:32:06,174",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3662
          },
          {
            "timestamp": "2026-05-28 22:32:06,174",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "281"
              },
              {
                "name": "y",
                "value": "597"
              }
            ],
            "repeated": 1,
            "id": 3663
          },
          {
            "timestamp": "2026-05-28 22:32:06,174",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3664
          },
          {
            "timestamp": "2026-05-28 22:32:06,174",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "281"
              },
              {
                "name": "y",
                "value": "597"
              }
            ],
            "repeated": 0,
            "id": 3665
          },
          {
            "timestamp": "2026-05-28 22:32:06,190",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "279"
              },
              {
                "name": "y",
                "value": "597"
              }
            ],
            "repeated": 0,
            "id": 3666
          },
          {
            "timestamp": "2026-05-28 22:32:06,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3667
          },
          {
            "timestamp": "2026-05-28 22:32:06,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "279"
              },
              {
                "name": "y",
                "value": "597"
              }
            ],
            "repeated": 0,
            "id": 3668
          },
          {
            "timestamp": "2026-05-28 22:32:06,221",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "275"
              },
              {
                "name": "y",
                "value": "595"
              }
            ],
            "repeated": 0,
            "id": 3669
          },
          {
            "timestamp": "2026-05-28 22:32:06,221",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3670
          },
          {
            "timestamp": "2026-05-28 22:32:06,221",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "275"
              },
              {
                "name": "y",
                "value": "595"
              }
            ],
            "repeated": 0,
            "id": 3671
          },
          {
            "timestamp": "2026-05-28 22:32:06,221",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "251"
              },
              {
                "name": "y",
                "value": "586"
              }
            ],
            "repeated": 0,
            "id": 3672
          },
          {
            "timestamp": "2026-05-28 22:32:06,221",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3673
          },
          {
            "timestamp": "2026-05-28 22:32:06,221",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "251"
              },
              {
                "name": "y",
                "value": "586"
              }
            ],
            "repeated": 0,
            "id": 3674
          },
          {
            "timestamp": "2026-05-28 22:32:06,252",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "218"
              },
              {
                "name": "y",
                "value": "571"
              }
            ],
            "repeated": 0,
            "id": 3675
          },
          {
            "timestamp": "2026-05-28 22:32:06,252",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3676
          },
          {
            "timestamp": "2026-05-28 22:32:06,252",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "218"
              },
              {
                "name": "y",
                "value": "571"
              }
            ],
            "repeated": 1,
            "id": 3677
          },
          {
            "timestamp": "2026-05-28 22:32:06,252",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3678
          },
          {
            "timestamp": "2026-05-28 22:32:06,252",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "218"
              },
              {
                "name": "y",
                "value": "571"
              }
            ],
            "repeated": 0,
            "id": 3679
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3680
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "216"
              },
              {
                "name": "y",
                "value": "570"
              }
            ],
            "repeated": 0,
            "id": 3681
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3682
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "216"
              },
              {
                "name": "y",
                "value": "570"
              }
            ],
            "repeated": 0,
            "id": 3683
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "213"
              },
              {
                "name": "y",
                "value": "569"
              }
            ],
            "repeated": 0,
            "id": 3684
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3685
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "213"
              },
              {
                "name": "y",
                "value": "569"
              }
            ],
            "repeated": 0,
            "id": 3686
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "209"
              },
              {
                "name": "y",
                "value": "567"
              }
            ],
            "repeated": 0,
            "id": 3687
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3688
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "209"
              },
              {
                "name": "y",
                "value": "567"
              }
            ],
            "repeated": 0,
            "id": 3689
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "207"
              },
              {
                "name": "y",
                "value": "565"
              }
            ],
            "repeated": 0,
            "id": 3690
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3691
          },
          {
            "timestamp": "2026-05-28 22:32:06,268",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "207"
              },
              {
                "name": "y",
                "value": "565"
              }
            ],
            "repeated": 0,
            "id": 3692
          },
          {
            "timestamp": "2026-05-28 22:32:06,283",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "204"
              },
              {
                "name": "y",
                "value": "564"
              }
            ],
            "repeated": 0,
            "id": 3693
          },
          {
            "timestamp": "2026-05-28 22:32:06,283",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3694
          },
          {
            "timestamp": "2026-05-28 22:32:06,283",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "204"
              },
              {
                "name": "y",
                "value": "564"
              }
            ],
            "repeated": 0,
            "id": 3695
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "183"
              },
              {
                "name": "y",
                "value": "552"
              }
            ],
            "repeated": 0,
            "id": 3696
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3697
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "183"
              },
              {
                "name": "y",
                "value": "552"
              }
            ],
            "repeated": 0,
            "id": 3698
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "181"
              },
              {
                "name": "y",
                "value": "550"
              }
            ],
            "repeated": 0,
            "id": 3699
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3700
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "181"
              },
              {
                "name": "y",
                "value": "550"
              }
            ],
            "repeated": 0,
            "id": 3701
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "179"
              },
              {
                "name": "y",
                "value": "549"
              }
            ],
            "repeated": 0,
            "id": 3702
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3703
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "179"
              },
              {
                "name": "y",
                "value": "549"
              }
            ],
            "repeated": 0,
            "id": 3704
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "178"
              },
              {
                "name": "y",
                "value": "549"
              }
            ],
            "repeated": 0,
            "id": 3705
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3706
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "178"
              },
              {
                "name": "y",
                "value": "549"
              }
            ],
            "repeated": 0,
            "id": 3707
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "175"
              },
              {
                "name": "y",
                "value": "548"
              }
            ],
            "repeated": 0,
            "id": 3708
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3709
          },
          {
            "timestamp": "2026-05-28 22:32:06,330",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "175"
              },
              {
                "name": "y",
                "value": "548"
              }
            ],
            "repeated": 0,
            "id": 3710
          },
          {
            "timestamp": "2026-05-28 22:32:06,362",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "150"
              },
              {
                "name": "y",
                "value": "537"
              }
            ],
            "repeated": 0,
            "id": 3711
          },
          {
            "timestamp": "2026-05-28 22:32:06,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3712
          },
          {
            "timestamp": "2026-05-28 22:32:06,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "150"
              },
              {
                "name": "y",
                "value": "537"
              }
            ],
            "repeated": 1,
            "id": 3713
          },
          {
            "timestamp": "2026-05-28 22:32:06,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3714
          },
          {
            "timestamp": "2026-05-28 22:32:06,362",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "150"
              },
              {
                "name": "y",
                "value": "537"
              }
            ],
            "repeated": 0,
            "id": 3715
          },
          {
            "timestamp": "2026-05-28 22:32:06,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3716
          },
          {
            "timestamp": "2026-05-28 22:32:06,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "147"
              },
              {
                "name": "y",
                "value": "535"
              }
            ],
            "repeated": 0,
            "id": 3717
          },
          {
            "timestamp": "2026-05-28 22:32:06,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3718
          },
          {
            "timestamp": "2026-05-28 22:32:06,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "147"
              },
              {
                "name": "y",
                "value": "535"
              }
            ],
            "repeated": 0,
            "id": 3719
          },
          {
            "timestamp": "2026-05-28 22:32:06,377",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "143"
              },
              {
                "name": "y",
                "value": "535"
              }
            ],
            "repeated": 0,
            "id": 3720
          },
          {
            "timestamp": "2026-05-28 22:32:06,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3721
          },
          {
            "timestamp": "2026-05-28 22:32:06,377",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "143"
              },
              {
                "name": "y",
                "value": "535"
              }
            ],
            "repeated": 0,
            "id": 3722
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "113"
              },
              {
                "name": "y",
                "value": "522"
              }
            ],
            "repeated": 0,
            "id": 3723
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3724
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "113"
              },
              {
                "name": "y",
                "value": "522"
              }
            ],
            "repeated": 1,
            "id": 3725
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3726
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "113"
              },
              {
                "name": "y",
                "value": "522"
              }
            ],
            "repeated": 0,
            "id": 3727
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "107"
              },
              {
                "name": "y",
                "value": "522"
              }
            ],
            "repeated": 0,
            "id": 3728
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3729
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "107"
              },
              {
                "name": "y",
                "value": "522"
              }
            ],
            "repeated": 0,
            "id": 3730
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "105"
              },
              {
                "name": "y",
                "value": "520"
              }
            ],
            "repeated": 0,
            "id": 3731
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3732
          },
          {
            "timestamp": "2026-05-28 22:32:06,408",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "105"
              },
              {
                "name": "y",
                "value": "520"
              }
            ],
            "repeated": 0,
            "id": 3733
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "100"
              },
              {
                "name": "y",
                "value": "519"
              }
            ],
            "repeated": 0,
            "id": 3734
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3735
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "100"
              },
              {
                "name": "y",
                "value": "519"
              }
            ],
            "repeated": 0,
            "id": 3736
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "95"
              },
              {
                "name": "y",
                "value": "517"
              }
            ],
            "repeated": 0,
            "id": 3737
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3738
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "95"
              },
              {
                "name": "y",
                "value": "517"
              }
            ],
            "repeated": 0,
            "id": 3739
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "93"
              },
              {
                "name": "y",
                "value": "516"
              }
            ],
            "repeated": 0,
            "id": 3740
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3741
          },
          {
            "timestamp": "2026-05-28 22:32:06,424",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "93"
              },
              {
                "name": "y",
                "value": "516"
              }
            ],
            "repeated": 0,
            "id": 3742
          },
          {
            "timestamp": "2026-05-28 22:32:06,487",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "49"
              },
              {
                "name": "y",
                "value": "504"
              }
            ],
            "repeated": 0,
            "id": 3743
          },
          {
            "timestamp": "2026-05-28 22:32:06,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3744
          },
          {
            "timestamp": "2026-05-28 22:32:06,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "49"
              },
              {
                "name": "y",
                "value": "504"
              }
            ],
            "repeated": 0,
            "id": 3745
          },
          {
            "timestamp": "2026-05-28 22:32:06,487",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 3746
          },
          {
            "timestamp": "2026-05-28 22:32:18,002",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "988"
              },
              {
                "name": "y",
                "value": "721"
              }
            ],
            "repeated": 0,
            "id": 3747
          },
          {
            "timestamp": "2026-05-28 22:32:18,002",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 3748
          },
          {
            "timestamp": "2026-05-28 22:32:18,049",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "583"
              },
              {
                "name": "y",
                "value": "605"
              }
            ],
            "repeated": 0,
            "id": 3749
          },
          {
            "timestamp": "2026-05-28 22:32:18,049",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3750
          },
          {
            "timestamp": "2026-05-28 22:32:18,049",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "583"
              },
              {
                "name": "y",
                "value": "605"
              }
            ],
            "repeated": 2,
            "id": 3751
          },
          {
            "timestamp": "2026-05-28 22:32:18,049",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3752
          },
          {
            "timestamp": "2026-05-28 22:32:18,049",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "583"
              },
              {
                "name": "y",
                "value": "605"
              }
            ],
            "repeated": 0,
            "id": 3753
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "368"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3754
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3755
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "368"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 1,
            "id": 3756
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3757
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "368"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3758
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "333"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3759
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3760
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "333"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3761
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "294"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3762
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3763
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "294"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3764
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "276"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3765
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3766
          },
          {
            "timestamp": "2026-05-28 22:32:18,096",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "276"
              },
              {
                "name": "y",
                "value": "621"
              }
            ],
            "repeated": 0,
            "id": 3767
          },
          {
            "timestamp": "2026-05-28 22:32:18,502",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 3768
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "332"
              },
              {
                "name": "y",
                "value": "363"
              }
            ],
            "repeated": 0,
            "id": 3769
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3770
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "332"
              },
              {
                "name": "y",
                "value": "363"
              }
            ],
            "repeated": 1,
            "id": 3771
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "352"
              },
              {
                "name": "y",
                "value": "361"
              }
            ],
            "repeated": 0,
            "id": 3772
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3773
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "352"
              },
              {
                "name": "y",
                "value": "361"
              }
            ],
            "repeated": 0,
            "id": 3774
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "371"
              },
              {
                "name": "y",
                "value": "361"
              }
            ],
            "repeated": 0,
            "id": 3775
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3776
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "371"
              },
              {
                "name": "y",
                "value": "361"
              }
            ],
            "repeated": 0,
            "id": 3777
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "383"
              },
              {
                "name": "y",
                "value": "360"
              }
            ],
            "repeated": 0,
            "id": 3778
          },
          {
            "timestamp": "2026-05-28 22:32:47,033",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3779
          },
          {
            "timestamp": "2026-05-28 22:32:47,049",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "383"
              },
              {
                "name": "y",
                "value": "360"
              }
            ],
            "repeated": 0,
            "id": 3780
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "424"
              },
              {
                "name": "y",
                "value": "359"
              }
            ],
            "repeated": 0,
            "id": 3781
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3782
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "424"
              },
              {
                "name": "y",
                "value": "359"
              }
            ],
            "repeated": 1,
            "id": 3783
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3784
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "424"
              },
              {
                "name": "y",
                "value": "359"
              }
            ],
            "repeated": 0,
            "id": 3785
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "460"
              },
              {
                "name": "y",
                "value": "358"
              }
            ],
            "repeated": 0,
            "id": 3786
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3787
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "460"
              },
              {
                "name": "y",
                "value": "358"
              }
            ],
            "repeated": 0,
            "id": 3788
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "483"
              },
              {
                "name": "y",
                "value": "357"
              }
            ],
            "repeated": 0,
            "id": 3789
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3790
          },
          {
            "timestamp": "2026-05-28 22:32:47,065",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "483"
              },
              {
                "name": "y",
                "value": "357"
              }
            ],
            "repeated": 0,
            "id": 3791
          },
          {
            "timestamp": "2026-05-28 22:32:47,080",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "498"
              },
              {
                "name": "y",
                "value": "357"
              }
            ],
            "repeated": 0,
            "id": 3792
          },
          {
            "timestamp": "2026-05-28 22:32:47,080",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3793
          },
          {
            "timestamp": "2026-05-28 22:32:47,080",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "550"
              },
              {
                "name": "y",
                "value": "354"
              }
            ],
            "repeated": 1,
            "id": 3794
          },
          {
            "timestamp": "2026-05-28 22:32:47,080",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3795
          },
          {
            "timestamp": "2026-05-28 22:32:47,080",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "550"
              },
              {
                "name": "y",
                "value": "354"
              }
            ],
            "repeated": 0,
            "id": 3796
          },
          {
            "timestamp": "2026-05-28 22:32:47,112",
            "thread_id": "7460",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "563"
              },
              {
                "name": "y",
                "value": "354"
              }
            ],
            "repeated": 0,
            "id": 3797
          },
          {
            "timestamp": "2026-05-28 22:32:47,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3798
          },
          {
            "timestamp": "2026-05-28 22:32:47,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "563"
              },
              {
                "name": "y",
                "value": "354"
              }
            ],
            "repeated": 0,
            "id": 3799
          },
          {
            "timestamp": "2026-05-28 22:32:47,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3800
          },
          {
            "timestamp": "2026-05-28 22:32:47,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "687"
              },
              {
                "name": "y",
                "value": "348"
              }
            ],
            "repeated": 0,
            "id": 3801
          },
          {
            "timestamp": "2026-05-28 22:32:47,112",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 4,
            "id": 3802
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05670000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3803
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3804
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05684000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3805
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05630000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3806
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05607000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3807
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055cc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3808
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05614000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3809
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05627000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3810
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0562a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3811
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3812
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3813
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3814
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de08af1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00014000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3815
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3816
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3817
          },
          {
            "timestamp": "2026-05-28 22:32:47,190",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0562a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3818
          },
          {
            "timestamp": "2026-05-28 22:32:47,221",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 39,
            "id": 3819
          },
          {
            "timestamp": "2026-05-28 22:32:47,627",
            "thread_id": "7460",
            "caller": "0x7ff726af05ad",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001016"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3820
          },
          {
            "timestamp": "2026-05-28 22:32:47,627",
            "thread_id": "7460",
            "caller": "0x7ff726af05ad",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001018"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3821
          },
          {
            "timestamp": "2026-05-28 22:32:47,846",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 70,
            "id": 3822
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x9d40cdeb90"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 3823
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af00d9",
            "parentcaller": "0x7ff726af0589",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x9d40cddc90"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 3824
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af00d9",
            "parentcaller": "0x7ff726af0589",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 2,
            "id": 3825
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af00d9",
            "parentcaller": "0x7ff726af0589",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000104e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3826
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af00d9",
            "parentcaller": "0x7ff726af0589",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x9d40cddc90"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 1,
            "id": 3827
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af00d9",
            "parentcaller": "0x7ff726af0589",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x001704b6"
              },
              {
                "name": "Message",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3828
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 3829
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af05f8",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 3830
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "mscoree.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3831
          },
          {
            "timestamp": "2026-05-28 22:32:48,674",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3832
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 3833
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 0,
            "id": 3834
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 3835
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 3836
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 3837
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 3838
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 3839
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 3840
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 3841
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 3842
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 3843
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 3844
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3845
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3846
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 3847
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96551090"
              }
            ],
            "repeated": 1,
            "id": 3848
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3849
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3850
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 3851
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3852
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3853
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000408"
              }
            ],
            "repeated": 0,
            "id": 3854
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000404"
              }
            ],
            "repeated": 0,
            "id": 3855
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3856
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3857
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwUnregisterTraceGuids"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0340"
              }
            ],
            "repeated": 0,
            "id": 3858
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              }
            ],
            "repeated": 0,
            "id": 3859
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3860
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3861
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3862
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwUnregisterTraceGuids"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0340"
              }
            ],
            "repeated": 0,
            "id": 3863
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 3864
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 3865
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3866
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3867
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a0"
              }
            ],
            "repeated": 0,
            "id": 3868
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 3869
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de089a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3870
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 3871
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 3872
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 3873
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000324"
              }
            ],
            "repeated": 0,
            "id": 3874
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000328"
              }
            ],
            "repeated": 0,
            "id": 3875
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 3876
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 3877
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3878
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3879
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 3880
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 3881
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3882
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3883
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 3884
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 3885
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3886
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 3887
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 3888
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 3889
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 3890
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 3891
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3892
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3893
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 3894
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 3895
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000028c"
              }
            ],
            "repeated": 0,
            "id": 3896
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 3897
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 3898
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 3899
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              }
            ],
            "repeated": 0,
            "id": 3900
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              }
            ],
            "repeated": 0,
            "id": 3901
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 3902
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 3903
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              }
            ],
            "repeated": 0,
            "id": 3904
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 3905
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 3906
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3907
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3908
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000220"
              }
            ],
            "repeated": 0,
            "id": 3909
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3910
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3911
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000021c"
              }
            ],
            "repeated": 0,
            "id": 3912
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000224"
              }
            ],
            "repeated": 0,
            "id": 3913
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000228"
              }
            ],
            "repeated": 0,
            "id": 3914
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98030000"
              }
            ],
            "repeated": 0,
            "id": 3915
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000023c"
              }
            ],
            "repeated": 0,
            "id": 3916
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              }
            ],
            "repeated": 0,
            "id": 3917
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 3918
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 3919
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000098"
              }
            ],
            "repeated": 0,
            "id": 3920
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f4"
              }
            ],
            "repeated": 0,
            "id": 3921
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000080"
              }
            ],
            "repeated": 0,
            "id": 3922
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000214"
              }
            ],
            "repeated": 0,
            "id": 3923
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3924
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3925
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05670000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3926
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05670000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3927
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3928
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055be000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3929
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de05621000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3930
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3931
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 3932
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000238"
              }
            ],
            "repeated": 0,
            "id": 3933
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de070a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3934
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002cc"
              }
            ],
            "repeated": 0,
            "id": 3935
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001d0"
              }
            ],
            "repeated": 0,
            "id": 3936
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001d4"
              }
            ],
            "repeated": 0,
            "id": 3937
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000d4"
              }
            ],
            "repeated": 0,
            "id": 3938
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001c4"
              }
            ],
            "repeated": 0,
            "id": 3939
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001a8"
              }
            ],
            "repeated": 0,
            "id": 3940
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001ac"
              }
            ],
            "repeated": 0,
            "id": 3941
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001a4"
              }
            ],
            "repeated": 0,
            "id": 3942
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000018c"
              }
            ],
            "repeated": 0,
            "id": 3943
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000190"
              }
            ],
            "repeated": 0,
            "id": 3944
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000194"
              }
            ],
            "repeated": 0,
            "id": 3945
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000198"
              }
            ],
            "repeated": 0,
            "id": 3946
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000019c"
              }
            ],
            "repeated": 0,
            "id": 3947
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001a0"
              }
            ],
            "repeated": 0,
            "id": 3948
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff986c1000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3949
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff986c1000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3950
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000184"
              }
            ],
            "repeated": 0,
            "id": 3951
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000188"
              }
            ],
            "repeated": 0,
            "id": 3952
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000180"
              }
            ],
            "repeated": 0,
            "id": 3953
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3954
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3955
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000164"
              }
            ],
            "repeated": 0,
            "id": 3956
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000168"
              }
            ],
            "repeated": 0,
            "id": 3957
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000016c"
              }
            ],
            "repeated": 0,
            "id": 3958
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000170"
              }
            ],
            "repeated": 0,
            "id": 3959
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000174"
              }
            ],
            "repeated": 0,
            "id": 3960
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000017c"
              }
            ],
            "repeated": 0,
            "id": 3961
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000178"
              }
            ],
            "repeated": 0,
            "id": 3962
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000144"
              }
            ],
            "repeated": 0,
            "id": 3963
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000148"
              }
            ],
            "repeated": 0,
            "id": 3964
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000140"
              }
            ],
            "repeated": 0,
            "id": 3965
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b8"
              }
            ],
            "repeated": 0,
            "id": 3966
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000013c"
              }
            ],
            "repeated": 0,
            "id": 3967
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000134"
              }
            ],
            "repeated": 0,
            "id": 3968
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000138"
              }
            ],
            "repeated": 0,
            "id": 3969
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000130"
              }
            ],
            "repeated": 0,
            "id": 3970
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000012c"
              }
            ],
            "repeated": 0,
            "id": 3971
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000128"
              }
            ],
            "repeated": 0,
            "id": 3972
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000392"
              }
            ],
            "repeated": 0,
            "id": 3973
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000011c"
              }
            ],
            "repeated": 0,
            "id": 3974
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000104"
              }
            ],
            "repeated": 0,
            "id": 3975
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000108"
              }
            ],
            "repeated": 0,
            "id": 3976
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000010c"
              }
            ],
            "repeated": 0,
            "id": 3977
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 3978
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000114"
              }
            ],
            "repeated": 0,
            "id": 3979
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000118"
              }
            ],
            "repeated": 0,
            "id": 3980
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000124"
              }
            ],
            "repeated": 0,
            "id": 3981
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000120"
              }
            ],
            "repeated": 0,
            "id": 3982
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000100"
              }
            ],
            "repeated": 0,
            "id": 3983
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000f8"
              }
            ],
            "repeated": 0,
            "id": 3984
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000fc"
              }
            ],
            "repeated": 0,
            "id": 3985
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000e4"
              }
            ],
            "repeated": 0,
            "id": 3986
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000e8"
              }
            ],
            "repeated": 0,
            "id": 3987
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000c4"
              }
            ],
            "repeated": 0,
            "id": 3988
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000c8"
              }
            ],
            "repeated": 0,
            "id": 3989
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000cc"
              }
            ],
            "repeated": 0,
            "id": 3990
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              }
            ],
            "repeated": 0,
            "id": 3991
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000cc"
              },
              {
                "name": "ValueName",
                "value": "DisableMetaFiles"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
              }
            ],
            "repeated": 0,
            "id": 3992
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000cc"
              }
            ],
            "repeated": 0,
            "id": 3993
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              }
            ],
            "repeated": 0,
            "id": 3994
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000cc"
              },
              {
                "name": "ValueName",
                "value": "DisableUmpdBufferSizeCheck"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck"
              }
            ],
            "repeated": 0,
            "id": 3995
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000cc"
              }
            ],
            "repeated": 0,
            "id": 3996
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de09600000"
              },
              {
                "name": "RegionSize",
                "value": "0x01260000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3997
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 3998
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 3999
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de0565e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4000
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1de055d1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4001
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b8"
              }
            ],
            "repeated": 0,
            "id": 4002
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b4"
              }
            ],
            "repeated": 0,
            "id": 4003
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b0"
              }
            ],
            "repeated": 0,
            "id": 4004
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 4005
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001e0"
              }
            ],
            "repeated": 0,
            "id": 4006
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000ac"
              }
            ],
            "repeated": 0,
            "id": 4007
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 4008
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 4009
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000064"
              }
            ],
            "repeated": 0,
            "id": 4010
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000044"
              }
            ],
            "repeated": 0,
            "id": 4011
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000005c"
              }
            ],
            "repeated": 0,
            "id": 4012
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 4013
          },
          {
            "timestamp": "2026-05-28 22:32:48,690",
            "thread_id": "7460",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4014
          }
        ],
        "threads": [
          "7460",
          "8844",
          "1164",
          "8840",
          "8964",
          "2864",
          "10600",
          "2644",
          "9288"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Windows\\system32\\msinfo32.exe\" ",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff726ad0000",
          "MainExeSize": "0x00067000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 5020,
        "process_name": "svchost.exe",
        "parent_id": 672,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "first_seen": "2026-05-28 22:31:59,322",
        "calls": [
          {
            "timestamp": "2026-05-28 22:31:59,744",
            "thread_id": "4820",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000032c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:31:59,744",
            "thread_id": "4820",
            "caller": "0x7fff970c41cf",
            "parentcaller": "0x7fff98c938c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:31:59,744",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98cafa80",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vssapi.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8c0b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0019e000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\vsstrace.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8c090000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00018000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\VssTrace"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c090000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\vssapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c0b0000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c9bb2a",
            "parentcaller": "0x7fff98c9b99e",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000030c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\VssTrace.DLL.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c9bbcc",
            "parentcaller": "0x7fff98c9b99e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000308"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x231b2f40000"
              },
              {
                "name": "SectionOffset",
                "value": "0xe4c4cfa470"
              },
              {
                "name": "ViewSize",
                "value": "0x00008000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\samcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000338"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8c070000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\samcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c070000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\netutils.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000344"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95850000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:31:59,759",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95850000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000308"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\samlib.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000338"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91fb0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00028000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SAMLIB"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91fb0000"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\ES"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e940000"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\es.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e940000"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\es.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e940000"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff8e94adf6",
            "parentcaller": "0x7fff8e94ad6e",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1BE1F766-5536-11D1-B726-00C04FB926AF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "64B8F404-A4AE-11D1-B7B6-00C04FB926AF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff8c0c3890",
            "parentcaller": "0x7fff8d0b6629",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "FAF53CC4-BD73-4E36-83F1-2B23F46E513E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff8e94adf6",
            "parentcaller": "0x7fff8e94ad6e",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1BE1F766-5536-11D1-B726-00C04FB926AF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "64B8F404-A4AE-11D1-B7B6-00C04FB926AF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff8c0bd980",
            "parentcaller": "0x7fff8c0c3907",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4E14FBA2-2E22-11D1-9964-00C04FBBB345"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "4E14FB9F-2E22-11D1-9964-00C04FBBB345"
              },
              {
                "name": "ProgID",
                "value": "EventSystem.EventSystem.1"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:31:59,775",
            "thread_id": "4820",
            "caller": "0x7fff8c0bde75",
            "parentcaller": "0x7fff8c0c3907",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7542E960-79C7-11D1-88F9-0080C7D771BF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000015",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "4A6B0E15-2E38-11D1-9965-00C04FBBB345"
              },
              {
                "name": "ProgID",
                "value": "EventSystem.EventSubscription"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff8e95aa0e",
            "parentcaller": "0x7fff8c0be248",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000017",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000035c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000358"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91eb0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f6000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91eb0000"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff98c9cb1e",
            "parentcaller": "0x7fff96523958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x231b4000000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff98c9cb70",
            "parentcaller": "0x7fff96523958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x231b4000000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\FastProx"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\esscli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fba0000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:31:59,790",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:31:59,806",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7fbb0a6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Security-Base-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:31:59,806",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 1,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:31:59,806",
            "thread_id": "4820",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:31:59,806",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:31:59,806",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:31:59,822",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff569d0a6f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\authZ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95060000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:31:59,822",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff569d0a6f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "authZ.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95060000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:31:59,822",
            "thread_id": "4820",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff950693bb",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000388",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff95069160"
              },
              {
                "name": "Parameter",
                "value": "0x231b1270180"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "9848"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:31:59,822",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:31:59,837",
            "thread_id": "4820",
            "caller": "0x7fff8d02c227",
            "parentcaller": "0x7fff569c7739",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:31:59,837",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8be60000"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:31:59,837",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wmiutils.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8be60000"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:31:59,837",
            "thread_id": "4820",
            "caller": "0x7fff8d02c227",
            "parentcaller": "0x7fff569c7811",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:31:59,837",
            "thread_id": "4820",
            "caller": "0x7fff8d02c227",
            "parentcaller": "0x7fff569c78e3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:31:59,837",
            "thread_id": "4820",
            "caller": "0x7fff5699a53c",
            "parentcaller": "0x7fff569c6f2d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "5839FCA9-774D-42A1-ACDA-D6A79037F57F"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "6963B029-B969-40AA-9180-2B2F84075973"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\repdrvfs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fab0000"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repdrvfs.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fab0000"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff569900c2",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7998DC37-D3FE-487C-A60A-7701FCC70CC6"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2AF77343-DD7B-11D2-9217-00AA001F98B5"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff96509dd2",
            "parentcaller": "0x7fff7fac9e57",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000035",
            "pretty_return": "OBJECT_NAME_COLLISION",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000173"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository"
              },
              {
                "name": "CreateDisposition",
                "value": "2",
                "pretty_value": "FILE_CREATE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff9654f15c",
            "parentcaller": "0x7fff7fac9e17",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100100",
                "pretty_value": "FILE_WRITE_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff9654f1d6",
            "parentcaller": "0x7fff7fac9e17",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003cc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x40110080",
                "pretty_value": "GENERIC_WRITE|FILE_READ_ATTRIBUTES|DELETE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\WRITABLE.TST"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b5f65",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff905b0000"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:31:59,853",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b5f65",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "Wevtapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff905b0000"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:31:59,869",
            "thread_id": "4820",
            "caller": "0x7fff964facfe",
            "parentcaller": "0x7fff8d0b61fd",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\Wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff905b0000"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:31:59,869",
            "thread_id": "4820",
            "caller": "0x7fff98cc0db0",
            "parentcaller": "0x7fff98c80391",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff905b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:31:59,869",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:31:59,869",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\MAPPING2.MAP"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:31:59,869",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:31:59,869",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7facb27e",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003bc"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING1.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7facb27e",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d4"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING2.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7facb27e",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING3.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0B\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0.\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0c\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe08\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x12\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80f\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0m\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80n\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0c\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:31:59,884",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00n\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0d\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80(\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00f\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@f\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`f\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:31:59,900",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0m\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0f\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 f\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0g\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0h\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 )\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`<\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 m\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0k\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:31:59,915",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@m\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80l\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`m\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@j\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`j\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0l\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0j\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0k\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`k\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0j\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@k\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@l\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 j\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00m\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0k\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`l\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0l\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 k\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0l\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00j\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 l\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 n\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 S\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\xc0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x02\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\t\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0&\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:31:59,931",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x81\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0H\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@B\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x86\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\xcd\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0?\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`A\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x9f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x92\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x9c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\xbd\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\xbf\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0G\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\xae\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x05\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`Q\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@@\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0?\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00S\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0H\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 L\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`N\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00R\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 R\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`R\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0R\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0R\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 W\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 Y\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0[\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\xc7\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0i\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80n\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:31:59,947",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 1\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x805\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x008\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80&\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x003\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`7\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x15\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80$\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@&\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`D\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x002\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 3\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x802\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 5\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x804\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0)\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 8\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:31:59,962",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x007\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x12\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00$\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x001\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x005\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`1\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 7\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x12\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`6\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0K\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x000\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@2\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80+\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 2\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x803\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x806\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x004\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x800\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@5\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0#\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0C\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`3\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0?\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@3\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`0\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x801\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:31:59,978",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0/\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0I\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@#\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0K\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7facb3c0",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d4"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING2.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7facb410",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d4"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING2.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\xe42\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7facb485",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d4"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\MAPPING2.MAP"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80n\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0K\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`2\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff8d02c227",
            "parentcaller": "0x7fff7faca0ff",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1860E246-E924-4F73-B2C5-93E0577E3AA1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff8d02c227",
            "parentcaller": "0x7fff7faca14c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9A653086-174F-11D2-B5F9-00104B703EFD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003a4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff973c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00079000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\coml2"
              },
              {
                "name": "DllBase",
                "value": "0x7fff973c0000"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff964facfe",
            "parentcaller": "0x7fff56982069",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\coml2"
              },
              {
                "name": "DllBase",
                "value": "0x7fff973c0000"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff98cc0db0",
            "parentcaller": "0x7fff98c80391",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff973c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff569820c8",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000003e8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff569cfaa0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10012"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:31:59,994",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff5698fb69",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7998DC37-D3FE-487C-A60A-7701FCC70CC6"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2AF77343-DD7B-11D2-9217-00AA001F98B5"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7fc4e314",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\amsi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d520000"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7fc4e314",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "amsi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d520000"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\userenv.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000408"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96220000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0002e000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\profapi.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000418"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96260000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00025000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96260000"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files\\Windows Defender\\MpOAV.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d5259a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files\\Windows Defender\\MpOav"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d4d0000"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d4f2dd5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d4f2dd5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d4ea2cd",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d4ea2cd",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d4ea2cd",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d4de4e9",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\version"
              },
              {
                "name": "DllBase",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d4de4e9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\version.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff7d5259a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files\\Windows Defender\\MpOAV.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d4d0000"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0.\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@*\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x1f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:32:00,009",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ]\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NCObjAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8bf60000"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvsd"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a940000"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\WmiPrvSD.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3a940000"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff3a97af6c",
            "parentcaller": "0x7fff3a9698ab",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1860E246-E924-4F73-B2C5-93E0577E3AA1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "5FC92893-A9BE-475F-BF9E-CF50EEA1C958"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d030db5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Security-Base-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8cfeab11",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8cfeab2c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d030ea9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-processsecurity-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff5694d607",
            "parentcaller": "0x7fff569c6b2c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4DE225BF-CF59-4CFC-85F7-68B90F185355"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "E8107BDF-BAAF-4C7C-BB5F-9D732E8D8F07"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemess"
              },
              {
                "name": "DllBase",
                "value": "0x7fff590a0000"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemess.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff590a0000"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff569c68f1",
            "parentcaller": "0x7fff569c71a5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "C0E3EEB3-B2CE-4A6A-9284-F38475CEE099"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff590eaa96",
            "parentcaller": "0x7fff569c699d",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98cafa80",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\cryptsp.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000460"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95bf0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00018000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cryptsp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95bf0000"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\rsaenh"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rsaenh.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95330000"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff9650e188",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x231b4400000"
              },
              {
                "name": "SectionOffset",
                "value": "0xe4c4cfcba0"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8bf6147c",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000488",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8bf64f50"
              },
              {
                "name": "Parameter",
                "value": "0x231b4316490"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10064"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff590eb01f",
            "parentcaller": "0x7fff569c699d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\esscli.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fba0000"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff590e68f5",
            "parentcaller": "0x7fff590eb0a1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "DC923725-0FDD-45E1-AE74-EA09182E739B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "B1EB126B-4A5E-4848-9E6A-5A513DC7F57A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x1b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x15\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff590e677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:32:00,025",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff590e677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff590e677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ?\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:32:00,040",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "4820",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff5694c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000004d0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff5694d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x231b4399380"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10164"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10164",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10164",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10164",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff5694c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000004fc",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff5694d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x231b4399bf0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10172"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10172",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000050c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 6\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 @\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10164",
            "caller": "0x7fff3a94dd6a",
            "parentcaller": "0x7fff3a94d989",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:32:00,056",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0 \\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x19\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "4820",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x19\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@6\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff3a957e1d",
            "parentcaller": "0x7fff3a957a50",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "81166F58-DD98-11D3-A120-00105A1F515A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:32:00,072",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:32:00,665",
            "thread_id": "4984",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:32:00,665",
            "thread_id": "4984",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:32:00,665",
            "thread_id": "4984",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:32:00,665",
            "thread_id": "4984",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "4984",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "4984",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10164",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10164",
            "caller": "0x7fff3a959ec9",
            "parentcaller": "0x7fff3a94b42b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1F87137D-0E7C-44D5-8C73-4EFFB68962F2"
              },
              {
                "name": "ClsContext",
                "value": "0x00090004",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_AAA|CLSCTX_ACTIVATE_64_BIT_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10164",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94cae0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "4984",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "4984",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10300",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000570"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:32:00,681",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10164",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000057c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000580"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a95978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10172",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10172",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005a0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10172",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000574"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:32:00,712",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10300",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x92\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10372",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000560"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff5694c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000005bc",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff5694d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x231b43db600"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10444"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 %\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000584"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000564"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000584"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000055c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10444",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10444",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10444",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005ac"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10444",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10444",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005b0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:32:00,728",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005dc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000057c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005dc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005b4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:32:00,790",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005dc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:32:00,806",
            "thread_id": "10164",
            "caller": "0x7fff3a957e1d",
            "parentcaller": "0x7fff3a957a50",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "81166F58-DD98-11D3-A120-00105A1F515A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:32:01,072",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:32:01,072",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:32:01,072",
            "thread_id": "4820",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:32:01,087",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:32:01,087",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:32:01,087",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:32:01,087",
            "thread_id": "10164",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:32:01,087",
            "thread_id": "10164",
            "caller": "0x7fff3a959ec9",
            "parentcaller": "0x7fff3a94b42b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "73E709EA-5D93-4B2E-BBB0-99B7938DA9E4"
              },
              {
                "name": "ClsContext",
                "value": "0x00090004",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_ENABLE_AAA|CLSCTX_ACTIVATE_64_BIT_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:32:01,103",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:32:01,103",
            "thread_id": "10164",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94cae0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:32:01,103",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:32:01,103",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:32:01,103",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:32:01,103",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:32:01,103",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:32:01,119",
            "thread_id": "4820",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:32:01,134",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:32:01,134",
            "thread_id": "10164",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:32:01,134",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:32:01,134",
            "thread_id": "10164",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:32:01,134",
            "thread_id": "10172",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:32:01,134",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:32:01,134",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1a\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0&\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80#\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 $\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`$\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`'\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0$\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@%\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x0e\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x13\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005d8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005e0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:32:01,150",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000058c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004c4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000608"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x05\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000610"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000610"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000060c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:32:01,165",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "10372",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000058c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:32:01,181",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 (\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10164",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a95a210",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94cae0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10372",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "10164",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:32:01,197",
            "thread_id": "4820",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "10372",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "10372",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "10372",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x06\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 '\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x86\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:32:01,212",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0,\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\xcb\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005d0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005d8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005d0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a95978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:32:01,228",
            "thread_id": "4820",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10172",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004ec"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005d0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004ec"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 ;\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80(\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x06\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x8a\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0%\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\xe7\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:32:01,244",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "4820",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10172",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000554"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005fc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80@\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a95a210",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94cae0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10172",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:32:01,259",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10164",
            "caller": "0x7fff3a954e9b",
            "parentcaller": "0x7fff3a956a2f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10164",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005b4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005b4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000514"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a95978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10172",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10372",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10372",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10372",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10372",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:32:01,275",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:32:01,384",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000580"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000580"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005f4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "4820",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "4820",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "4820",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "4820",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:32:01,400",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000064c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000618"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000064c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000628"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a95978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "4820",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "4820",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "4820",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000057c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000580"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000057c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000638"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10444",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10444",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:32:01,415",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10300",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004bc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000650"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004bc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000644"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10300",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000052c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000614"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000052c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000644"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:32:01,431",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10300",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10172",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000051c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005e0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10300",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000514"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005f4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000514"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000051c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:32:01,447",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004ec"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005e0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004ec"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000051c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:32:01,462",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10372",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 795
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000590"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000618"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000590"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004ec"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a95978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10172",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff3a960d6b",
            "parentcaller": "0x7fff56935b44",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a961fb1",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 812
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004e0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005c8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004e0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000514"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-05-28 22:32:01,478",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10300",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10300",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10300",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10300",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10300",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 824
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000600"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004ec"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000600"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004e0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a95978f",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-05-28 22:32:01,494",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-05-28 22:32:01,587",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-05-28 22:32:01,587",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000050c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000638"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-05-28 22:32:01,587",
            "thread_id": "10164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000050c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000600"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-05-28 22:32:01,587",
            "thread_id": "10172",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-05-28 22:32:01,587",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-05-28 22:32:01,587",
            "thread_id": "10172",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-05-28 22:32:01,603",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-05-28 22:32:01,603",
            "thread_id": "10164",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a9773be",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-05-28 22:32:01,603",
            "thread_id": "10164",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "10016",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8cff46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000005ac",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8cff4a00"
              },
              {
                "name": "Parameter",
                "value": "0x231b43db6a0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8024"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "10016",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8cff46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000005b8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8cff4a00"
              },
              {
                "name": "Parameter",
                "value": "0x231b43db790"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8128"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0 \\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x1b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff5694c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000005a0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff5694d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x231b4873190"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8700"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000510"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000380"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff96524448",
            "parentcaller": "0x7fff7fbb041d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x231b2f80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x93\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff590c4e5e",
            "parentcaller": "0x7fff590a8ca7",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "A57BE31E-EFE3-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8cff46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000530",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8cff4a00"
              },
              {
                "name": "Parameter",
                "value": "0x231b12fec80"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "5836"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8024",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8cff46f4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000005e8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8cff4a00"
              },
              {
                "name": "Parameter",
                "value": "0x231b1256a00"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "3784"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 858
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff5694c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000004b4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff5694d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x231b1276f50"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8580"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 859
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005b4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000658"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000057c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004d0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 865
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f4fe",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 867
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff5694c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000520",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff5694d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x231b43db830"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "3676"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000003c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005b4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 869
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000003c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004c8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x11\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 873
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\xf8\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000518"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000518"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000514"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000518"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005b4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 877
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000518"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004f4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff5694c946",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000624",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff5694d7c0"
              },
              {
                "name": "Parameter",
                "value": "0x231b48e2f60"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "7436"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 879
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x96\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8128",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8cfefcc4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000518",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8cfef6d0"
              },
              {
                "name": "Parameter",
                "value": "0x231b43160e0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "11940"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x9a\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x14\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x91\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\xbb\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "5836",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 890
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\xcb\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x17\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004bc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 895
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-05-28 22:32:47,744",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 '\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004bc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 899
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000614"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 900
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000004f4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000060c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x84\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc06\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 905
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x87\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x02\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x15\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0%\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 909
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x98\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x10\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 912
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 46,
            "id": 913
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@%\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 914
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000638"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000694"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 916
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@!\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x16\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 918
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80)\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x11\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 921
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 924
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff3a94dd6a",
            "parentcaller": "0x7fff3a94d989",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 8,
            "id": 926
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff3a957e1d",
            "parentcaller": "0x7fff3a957a50",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "81166F58-DD98-11D3-A120-00105A1F515A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x08\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x8f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x1c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\r\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0B\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x94\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80&\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 935
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-05-28 22:32:47,759",
            "thread_id": "8024",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 937
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 938
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006cc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006e4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 939
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006cc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006cc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006ec"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006cc"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006f0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 943
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 944
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 946
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a959ec9",
            "parentcaller": "0x7fff3a949afd",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BEBCE8B-1AF0-4323-8B4D-36994567CAE1"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94cae0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 948
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a94410f",
            "parentcaller": "0x7fff3a94cc36",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a959ec9",
            "parentcaller": "0x7fff3a959d5b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 950
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff8be62508",
            "parentcaller": "0x7fff8be64a51",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 7,
            "id": 951
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\ncprov"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 952
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\NCProv.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a942b67",
            "parentcaller": "0x7fff3a9429af",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "29F06F0C-FB7F-44A5-83CD-D41705D5C525"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": "NCProv.NCProvider.1"
              }
            ],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a959ec9",
            "parentcaller": "0x7fff3a959d5b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff7fc48cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000634"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a959ec9",
            "parentcaller": "0x7fff3a959d5b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 957
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff7fc48cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006b4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a95a647",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 959
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff7fc48cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006c8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006f4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a943e1c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 961
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8024",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff7fc48cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006f4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006c8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x15\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x8b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\\x0f\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x1d\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x80\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 970
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 %\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x18\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x12\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xa0\\x89\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x11\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00 \\x12\\x01\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-05-28 22:32:47,775",
            "thread_id": "8700",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-05-28 22:32:47,790",
            "thread_id": "8024",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a943c7c",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 979
          },
          {
            "timestamp": "2026-05-28 22:32:47,790",
            "thread_id": "8024",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff7fc48cba",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006f4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006cc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-05-28 22:32:47,790",
            "thread_id": "8024",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff7fb74423",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000006c8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff7fb72e40"
              },
              {
                "name": "Parameter",
                "value": "0x231b48dc040"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "2360"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-05-28 22:32:47,790",
            "thread_id": "10064",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x100c800c80000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 9,
            "id": 982
          },
          {
            "timestamp": "2026-05-28 22:32:47,790",
            "thread_id": "10064",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8bf6488a",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000006cc",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8bf63ca0"
              },
              {
                "name": "Parameter",
                "value": "0x231b12c1a90"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "6292"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-05-28 22:32:47,790",
            "thread_id": "10048",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x1007000700000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 9,
            "id": 984
          },
          {
            "timestamp": "2026-05-28 22:32:47,790",
            "thread_id": "10048",
            "caller": "0x7fff98b6b8ed",
            "parentcaller": "0x7fff8bf6488a",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000006d4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8bf63ca0"
              },
              {
                "name": "Parameter",
                "value": "0x231b4316e40"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "1540"
              },
              {
                "name": "ProcessId",
                "value": "5020"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-05-28 22:32:52,947",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 986
          },
          {
            "timestamp": "2026-05-28 22:32:52,947",
            "thread_id": "10372",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-05-28 22:32:52,947",
            "thread_id": "10372",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "10372",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 989
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "10372",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 991
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "10300",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 994
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 995
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000070c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000714"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 996
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff3a94dd6a",
            "parentcaller": "0x7fff3a94d989",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 8,
            "id": 997
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff3a957e1d",
            "parentcaller": "0x7fff3a957a50",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "81166F58-DD98-11D3-A120-00105A1F515A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000070c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-05-28 22:32:52,962",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000700"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1001
          },
          {
            "timestamp": "2026-05-28 22:32:52,978",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006a4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000640"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-05-28 22:32:52,978",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000006a4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000708"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-05-28 22:32:52,978",
            "thread_id": "8580",
            "caller": "0x7fff3a952823",
            "parentcaller": "0x7fff3a94ffb3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-05-28 22:32:52,978",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000720"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-05-28 22:32:52,978",
            "thread_id": "8580",
            "caller": "0x7fff7fc4a85f",
            "parentcaller": "0x7fff7fc4a778",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-05-28 22:32:52,978",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000710"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10300",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10300",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10300",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1010
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\OBJECTS.DATA"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x8b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10372",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 1012
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xe0\\x04\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1013
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10372",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1014
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1015
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "12508",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006ec"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "8700",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "8700",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1018
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "8700",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "8700",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 1020
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000714"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000738"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1021
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "12508",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-05-28 22:32:53,790",
            "thread_id": "12508",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-05-28 22:32:53,806",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-05-28 22:32:53,806",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-05-28 22:32:53,806",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1026
          },
          {
            "timestamp": "2026-05-28 22:32:53,806",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-05-28 22:32:53,806",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-05-28 22:32:53,806",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1030
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8d0b359f",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemcore.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff56920000"
              }
            ],
            "repeated": 0,
            "id": 1031
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff8d0b35f7",
            "parentcaller": "0x7fff9702b20e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1032
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 1033
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xc0\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1034
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff9653befb",
            "parentcaller": "0x7fff7faba158",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\wbem\\Repository\\INDEX.BTR"
              },
              {
                "name": "FileInformationClass",
                "value": "14",
                "pretty_value": "FilePositionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00@\\x01\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1035
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1036
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 1037
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8700",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1038
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8700",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1039
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8700",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1040
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8700",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff590e677f",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1041
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000071c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000006f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1042
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000074c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000071c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8024",
            "caller": "0x7fff590b85a4",
            "parentcaller": "0x7fff590b829c",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6C19BE35-7500-11D1-AD94-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DDDAA3DC-2907-41AD-9E74-A91B5AF092D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1044
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8024",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8024",
            "caller": "0x7fff3a953a1a",
            "parentcaller": "0x7fff56938f9b",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1046
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8024",
            "caller": "0x7fff8cff2c1e",
            "parentcaller": "0x7fff56939057",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "44ACA674-E8FC-11D0-A07C-00C04FB68820"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1047
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8024",
            "caller": "0x7fff56936b2d",
            "parentcaller": "0x7fff3a94f3e9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CD1ABFC8-6C5E-4A8D-B90B-2A3B153B886D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 1048
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000764"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000074c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1049
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000758"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000072c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000758"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000760"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1051
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000758"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000073c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8580",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000758"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000074c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1053
          },
          {
            "timestamp": "2026-05-28 22:32:53,822",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000724"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000073c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-05-28 22:32:53,837",
            "thread_id": "8700",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff8cfeb50c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000077c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000718"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-05-28 22:32:53,837",
            "thread_id": "10372",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc2d5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-05-28 22:32:53,837",
            "thread_id": "10372",
            "caller": "0x7fff56938250",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CC9072AB-C000-49D8-A5AA-00266C8DBB9B"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "368732C2-80D8-403E-854B-1B2BAFB9842C"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-05-28 22:32:54,978",
            "thread_id": "4736",
            "caller": "0x7ff71f594340",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4FA18276-912A-11D1-AD9B-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1058
          }
        ],
        "threads": [
          "4820",
          "10164",
          "10172",
          "4984",
          "10300",
          "10372",
          "10444",
          "10016",
          "8128",
          "8024",
          "8700",
          "5836",
          "8580",
          "10064",
          "10048",
          "12508",
          "4736"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff71f590000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 2380,
        "process_name": "msinfo32.exe",
        "parent_id": 4676,
        "module_path": "C:\\Windows\\System32\\msinfo32.exe",
        "first_seen": "2026-05-28 22:31:59,430",
        "calls": [
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2404",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98030000"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2404",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98030000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2404",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68551f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2404",
            "caller": "0x7fff98c9cb1e",
            "parentcaller": "0x7fff96523958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688770000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2404",
            "caller": "0x7fff98c9cb70",
            "parentcaller": "0x7fff96523958",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688770000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2404",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:31:59,508",
            "thread_id": "2404",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "714"
              },
              {
                "name": "y",
                "value": "58"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff7d359253",
            "parentcaller": "0x7fff7d35d8bd",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b686e70bb0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff7d350000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#3585"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff964fe6a1",
            "parentcaller": "0x7fff7d351666",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\MFC42LOC.DLL"
              },
              {
                "name": "dwFlags",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff964fe6a1",
            "parentcaller": "0x7fff7d351666",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\mfc42u"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d350000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff7d36f760"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\atl"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92000000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff92001d50"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b642c4",
            "parentcaller": "0x7fff98b63b55",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b64459",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000250"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004",
                "pretty_value": "SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b644a6",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000250"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686e80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff98b75ec5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xd9Y\\xd5\\xdd\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xc8\\xc1\\x15S\\xff\\x7f\\x00\\x00\\xc0\\xdaY\\xd5\\xdd\\x00\\x00\\x00\\xb8\\xc1\\x15S\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xc1\\x15S\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b5e7a0",
            "parentcaller": "0x7fff98b65084",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000025c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b5e7f0",
            "parentcaller": "0x7fff98b65084",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000025c"
              },
              {
                "name": "ValueName",
                "value": "PreferExternalManifest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b5e818",
            "parentcaller": "0x7fff98b65084",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b76103",
            "parentcaller": "0x7fff98b651de",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\WindowsShell.Manifest"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x9e\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b64f83",
            "parentcaller": "0x7fff98b6468c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b64f8a",
            "parentcaller": "0x7fff98b6468c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b6468c",
            "parentcaller": "0x7fff98b63b55",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686e80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b62a0e",
            "parentcaller": "0x7fff82f33a53",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "ThemePropScrollBarCtl"
              },
              {
                "name": "Atom",
                "value": "0x0000c01b"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff98b62a0e",
            "parentcaller": "0x7fff82f33a6d",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "MicrosoftTabletPenServiceProperty"
              },
              {
                "name": "Atom",
                "value": "0x0000c01c"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff82f33bac",
            "parentcaller": "0x7fff82f33add",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001022"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff82f33aeb",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "LPK"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff82f33b03",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "GDI32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98480000"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff82f33b1e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98480000"
              },
              {
                "name": "FunctionName",
                "value": "LpkEditControl"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff984a5740"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:31:59,524",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff82f33b1e",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\comctl32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff82f69e70"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff982e49b0",
            "parentcaller": "0x7fff98315a51",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\comdlg32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982e0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff98313a50"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98d0e53f",
            "parentcaller": "0x7fff98c6faf7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "UMPDC.dll"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\umpdc.dll"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\umpdc.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98cafcfe",
            "parentcaller": "0x7fff98caf7b0",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000260"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000025c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\umpdc.dll"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000260"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96170000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c5fee4",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96180000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c5ffb5",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c65082",
            "parentcaller": "0x7fff98c679d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98cafd68",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025c"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9617a000"
              },
              {
                "name": "ModuleName",
                "value": "UMPDC.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:31:59,539",
            "thread_id": "2404",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\umpdc"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96170000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96173e30"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff961b0000"
              },
              {
                "name": "ModuleName",
                "value": "POWRPROF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff961b0000"
              },
              {
                "name": "ModuleName",
                "value": "POWRPROF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\powrprof"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96190000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96193480"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff96524f76",
            "parentcaller": "0x7fff94e445b3",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e445d6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92e80"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e445ef",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0390"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e44608",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d10"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e44621",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c9f1b0"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff964fba2b",
            "parentcaller": "0x7fff94e4a61b",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\sppc"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94e40000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94e43920"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff96524f76",
            "parentcaller": "0x7fff94e7166e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e71697",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92e80"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716b6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0390"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716d5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d10"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716f4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c9f1b0"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff94e716f4",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\slc"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94e70000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94e71bd0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "2404",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff726af1440"
              },
              {
                "name": "Parameter",
                "value": "0xddd57ce000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "6572",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c677c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "8132",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "8132",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71ed0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5980",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "5980",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71e10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "6572",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:31:59,555",
            "thread_id": "6572",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f72030"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:31:59,571",
            "thread_id": "6468",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:31:59,571",
            "thread_id": "6468",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71a00"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af1a71",
            "parentcaller": "0x7ff726af1298",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff726af1a20"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af11be",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685522000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af11be",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686e17000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af11be",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686e18000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726ad4821",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686e19000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726ad55c5",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686e1a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726ad57be",
            "parentcaller": "0x7ff726af12dd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6854a1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af0896",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686e80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af0896",
            "parentcaller": "0x7ff726af1399",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000280"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000260"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000260"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000284"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9421f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94213f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685523000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:31:59,586",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff93cf0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\uxtheme.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "uxtheme.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff93cf0000"
              },
              {
                "name": "FunctionName",
                "value": "ThemeInitApiHook"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff93cfcde0"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xecY\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000290"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "AppsUseLightTheme"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08a4",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000029c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000029c"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000029c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000029c"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68552c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x0000029c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000029c"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf2Y\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x10\\xf3Y\\xd5\\xdd\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000029c"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a2"
              },
              {
                "name": "SubKey",
                "value": "AppID\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64GetCurrentMachine"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d90"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64IsWowGuestMachineSupported"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccc670"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a2"
              },
              {
                "name": "SubKey",
                "value": "AppID\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf7Y\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6CP\\x96\\xff\\x7f\\x00\\x00\\xa7\\xbf\\xec\\xa9am\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af08db",
            "parentcaller": "0x7ff726af1399",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af0649",
            "parentcaller": "0x7ff726af094c",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x2b6854f223a",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af065d",
            "parentcaller": "0x7ff726af094c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d37000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af065d",
            "parentcaller": "0x7ff726af094c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d37000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af065d",
            "parentcaller": "0x7ff726af094c",
            "category": "misc",
            "api": "CommandLineToArgvW",
            "status": true,
            "return": "0x2b685506e90",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Windows\\system32\\msinfo32.exe\" "
              },
              {
                "name": "NumArgs",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af0476",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490cf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#9"
              },
              {
                "name": "Name",
                "value": "#213"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af0476",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b685497498",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b685490cf0"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490aa0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#5"
              },
              {
                "name": "Name",
                "value": "#400"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b6854914a0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b685490aa0"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685530000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685535000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000288"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000288"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000288"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "MSCTF.dll"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000288"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00114000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdb000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdb000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:31:59,602",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x7fff97f00000"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msctf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff97f40760"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000254"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\ThemeSection"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000254"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686eb0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd559e520"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000224"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Windows\\Theme770907464"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000228"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\Theme928852983"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686eb0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000224"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688870000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd559ec40"
              },
              {
                "name": "ViewSize",
                "value": "0x000e2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000228"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686eb0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd559ec40"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:2380:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b686ec07d0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#4"
              },
              {
                "name": "Name",
                "value": "#16"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b686ec1190",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b686ec07d0"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "user32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686ea2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000288"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000009",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "ResourcePolicies"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6883f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00032000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6883f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686ea4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686ea5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x00000254"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x00000254"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68553a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 3,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xedY\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00`\\xc2\\xd6\\x97\\xff\\x7f\\x00\\x00\\x83\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x06\\x01\\x00\\x00\\x00\\x00\\x00\\xc4\\x1e\\x93\\x96\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000204"
              },
              {
                "name": "SubKey",
                "value": "Control Panel\\Desktop"
              },
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:31:59,618",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "SmoothScroll"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000204"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              },
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "EnableBalloonTips"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "ListviewAlphaSelect"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "ListviewShadow"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              },
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "AccListViewV6"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              },
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "ValueName",
                "value": "UseDoubleClickTimer"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686ea6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f55670"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000090"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b5a190"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b70170"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000254"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000254"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689150000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd559de90"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000254"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000254"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000254"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68553c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              },
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ac"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "67"
              },
              {
                "name": "MaxValueNameLength",
                "value": "27"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68553e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "Lucida Sans Unicode"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lucida Sans Unicode"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "Microsoft Sans Serif"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft Sans Serif"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "Tahoma"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Tahoma"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Bold"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Light"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI Semibold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Segoe UI Semibold"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "Ebrima"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Ebrima"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "Ebrima Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Ebrima Bold"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "Gadugi"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gadugi"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "Gadugi Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gadugi Bold"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "Khmer UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Khmer UI"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "ValueName",
                "value": "Khmer UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Khmer UI Bold"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "ValueName",
                "value": "Lao UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lao UI"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "ValueName",
                "value": "Lao UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Lao UI Bold"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee Bold"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee UI"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "ValueName",
                "value": "Leelawadee UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Leelawadee UI Bold"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI Bold"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "ValueName",
                "value": "Nirmala UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Nirmala UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "ValueName",
                "value": "MingLiU"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "ValueName",
                "value": "PMingLiU"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\PMingLiU"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "ValueName",
                "value": "MingLiU_HKSCS"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU_HKSCS"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "ValueName",
                "value": "MingLiU-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU-ExtB"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "ValueName",
                "value": "PMingLiU-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\PMingLiU-ExtB"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "ValueName",
                "value": "MingLiU_HKSCS-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MingLiU_HKSCS-ExtB"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei Bold"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI Bold"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "ValueName",
                "value": "Microsoft JhengHei UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft JhengHei UI Light"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "ValueName",
                "value": "SimSun"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\SimSun"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "ValueName",
                "value": "SimSun-ExtB"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\SimSun-ExtB"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "ValueName",
                "value": "NSimSun"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\NSimSun"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei Bold"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI Bold"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "ValueName",
                "value": "Microsoft YaHei UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Microsoft YaHei UI Light"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Bold"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Light"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Light"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Semilight"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "ValueName",
                "value": "Yu Gothic UI Semibold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Yu Gothic UI Semibold"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "ValueName",
                "value": "Meiryo"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:31:59,633",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "ValueName",
                "value": "Meiryo Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo Bold"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "ValueName",
                "value": "Meiryo UI"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo UI"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "ValueName",
                "value": "Meiryo UI Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Meiryo UI Bold"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "ValueName",
                "value": "MS Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS Gothic"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "ValueName",
                "value": "MS PGothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS PGothic"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "ValueName",
                "value": "MS UI Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS UI Gothic"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "ValueName",
                "value": "MS Mincho"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS Mincho"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "ValueName",
                "value": "MS PMincho"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\MS PMincho"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "ValueName",
                "value": "Batang"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Batang"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "ValueName",
                "value": "BatangChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\BatangChe"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "ValueName",
                "value": "Dotum"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Dotum"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "ValueName",
                "value": "DotumChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\DotumChe"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "ValueName",
                "value": "Gulim"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gulim"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "ValueName",
                "value": "GulimChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\GulimChe"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "ValueName",
                "value": "Gungsuh"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Gungsuh"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "ValueName",
                "value": "GungsuhChe"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\GungsuhChe"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic Bold"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic Bold"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "ValueName",
                "value": "Malgun Gothic Semilight"
              },
              {
                "name": "Type",
                "value": "7",
                "pretty_value": "REG_MULTI_SZ"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\Malgun Gothic Semilight"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "0",
                "pretty_value": "REG_NONE"
              },
              {
                "name": "DataLength",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink\\"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685541000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              },
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "Disable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "DataFilePath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\staticcache.dat"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x00\\x00&\\x01\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              },
              {
                "name": "Buffer",
                "value": "\\x1a\\x83W\\xa5\\x02\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00$\\x01\\x00\\x00$)\\x00\\x00\\x00\\x00\\x02\\x00\\xbe\\x02\\x00\\x00<\\x00\\x00\\x00$!\\x00\\x00L)\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00"
              },
              {
                "name": "Length",
                "value": "60"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Fonts\\StaticCache.dat"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002bc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689490000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd559ced0"
              },
              {
                "name": "ViewSize",
                "value": "0x01260000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685548000"
              },
              {
                "name": "RegionSize",
                "value": "0x00015000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68553f000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:2380:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002ac"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextShaping.dll"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002a8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff87ff0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000ac000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8803f000"
              },
              {
                "name": "ModuleName",
                "value": "TextShaping.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\TextShaping"
              },
              {
                "name": "DllBase",
                "value": "0x7fff87ff0000"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\TextShaping"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff87ff0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8803a790"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96a65000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:31:59,649",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96a65000"
              },
              {
                "name": "ModuleName",
                "value": "gdi32full.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68553f000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane2"
              },
              {
                "name": "Data",
                "value": "SimSun-ExtB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Plane16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ac"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "4"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "13"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "MingLiU"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MingLiU"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MingLiU_HKSCS"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MingLiU_HKSCS"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "PMingLiU"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\PMingLiU"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "SimSun"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\SimSun"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ac"
              },
              {
                "name": "SubKey",
                "value": "Segoe UI"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:31:59,664",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 1,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtAddAtomEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "AtomName",
                "value": "UxSubclassInfo"
              },
              {
                "name": "Atom",
                "value": "0x0000c018"
              }
            ],
            "repeated": 1,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              },
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "Segoe UI"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f55670"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 3,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassNameW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f55670"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 17,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726ae9bf8",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490a60",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#4"
              },
              {
                "name": "Name",
                "value": "#200"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726ae9bf8",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b685490e2c",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b685490a60"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726ae9c12",
            "parentcaller": "0x7ff726af019f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686ea7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726ada291",
            "parentcaller": "0x7ff726ad97b6",
            "category": "synchronization",
            "api": "NtCreateEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              },
              {
                "name": "EventName",
                "value": "MSInfoDone{42685650-2193-44A6-9979-52711F3BA0B5}"
              },
              {
                "name": "EventType",
                "value": "0"
              },
              {
                "name": "InitialState",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726ada2fb",
            "parentcaller": "0x7ff726ad97b6",
            "category": "synchronization",
            "api": "NtCreateEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              },
              {
                "name": "EventName",
                "value": "MSInfoStart{42685650-2193-44A6-9979-52711F3BA0B5}"
              },
              {
                "name": "EventType",
                "value": "0"
              },
              {
                "name": "InitialState",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aec350",
            "parentcaller": "0x7ff726aec19b",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000404f8"
              },
              {
                "name": "Message",
                "value": "0x00002100"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aec350",
            "parentcaller": "0x7ff726aec19b",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "547"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 1,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aec1cf",
            "parentcaller": "0x7ff726aea165",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x000404f8"
              },
              {
                "name": "Message",
                "value": "0x00002100"
              }
            ],
            "repeated": 1,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aec208",
            "parentcaller": "0x7ff726aea165",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686ea8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002a8"
              },
              {
                "name": "ValueName",
                "value": "PreferExternalManifest"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x001200a9",
                "pretty_value": "FILE_GENERIC_READ|FILE_GENERIC_EXECUTE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll.Config"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:31:59,680",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00120089",
                "pretty_value": "FILE_GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "comctl32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82ed0000"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82ed0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "comctl32"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688440000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "HIMAGELIST_QueryInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f4fa20"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DrawShadowText"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fccfe0"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DrawSizeBox"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f5f780"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DrawScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f40d20"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "SizeBoxHwnd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f452d0"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_MouseMove"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc21e0"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "ScrollBar_Menu"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc1ff0"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "HandleScrollCmd"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc1f50"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "DetachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82ed2440"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "AttachScrollBars"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f47150"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "CCSetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f42230"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "CCGetScrollInfo"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82f5bcc0"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "CCEnableScrollBar"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82ed2830"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82ed0000"
              },
              {
                "name": "FunctionName",
                "value": "QuerySystemGestureStatus"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82fc1fb0"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000068"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000006c"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000026"
              },
              {
                "name": "uiParam",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000103e"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00001042"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x0000001b"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8311a000"
              },
              {
                "name": "ModuleName",
                "value": "COMCTL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:2380:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:2380:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002cc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000006"
              },
              {
                "name": "ObjectAttributes",
                "value": "windows_shell_global_counters"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002cc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688440000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd559d1b0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "ValueName",
                "value": "TurnOffSPIAnimations"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aecbd6",
            "parentcaller": "0x7ff726aea5a8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aed8c2",
            "parentcaller": "0x7ff726aecc3c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490ab0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#7"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726aecc4d",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726aecc4d",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726ada49e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726ada46d",
            "parentcaller": "0x7ff726ada49e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726ada41a",
            "parentcaller": "0x7ff726ad9c4d",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002d0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff726ada4e0"
              },
              {
                "name": "Parameter",
                "value": "0x2b686e1c9b0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "9544"
              },
              {
                "name": "ProcessId",
                "value": "2380"
              },
              {
                "name": "Module",
                "value": "msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726ada41a",
            "parentcaller": "0x7ff726ad9c4d",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002d0",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff726ada4e0"
              },
              {
                "name": "Parameter",
                "value": "0x2b686e1c9b0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "9544"
              },
              {
                "name": "ProcessId",
                "value": "2380"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aee88a",
            "parentcaller": "0x7ff726aec215",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#24"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aea178",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490cf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#9"
              },
              {
                "name": "Name",
                "value": "#213"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aea178",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b685497498",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b685490cf0"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aea1bc",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000030"
              },
              {
                "name": "uiParam",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "9544",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "9544",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff726ada4e0"
              },
              {
                "name": "Parameter",
                "value": "0x2b686e1c9b0"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "9544",
            "caller": "0x7ff726ad7fe9",
            "parentcaller": "0x7ff726ada590",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "9544",
            "caller": "0x7ff726ad7ffe",
            "parentcaller": "0x7ff726ada590",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b00",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#23"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "9544",
            "caller": "0x7ff726ad8013",
            "parentcaller": "0x7ff726ada590",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x7ff726b11660",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#399"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x7ff726b23c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x7ff726b11660"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x7ff726b11560",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "Type",
                "value": "#3"
              },
              {
                "name": "Name",
                "value": "#11"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726aea213",
            "parentcaller": "0x7ff726af019f",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x7ff726b21d78",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7ff726ad0000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x7ff726b11560"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49238"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "ChangeWindowMessageFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "message",
                "value": "49239"
              },
              {
                "name": "dwFlag",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 1,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.Asm.MutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "Milliseconds",
                "value": "2000"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Local\\CTF.AsmListCache.FMPDefault1"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688450000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd559e120"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688450000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemMetrics",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemMetricIndex",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "MutexName",
                "value": "CicLoadWinStaWinSta0"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "MutexName",
                "value": "Local\\MSCTF.CtfMonitorInstMutexDefault1"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "ValueName",
                "value": "LaunchUserOOBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:2380:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\textinputframework.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TextInputFramework.dll"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a6e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98cafa80",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreUIComponents.dll"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93160000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0035b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9346c000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "wintypes.dll"
              }
            ],
            "repeated": 2,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93840000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:31:59,696",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ntmarta.dll"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95450000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00033000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95480000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CoreMessaging.dll"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002f8"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92180000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00155000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff922bd000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92276000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92275000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              }
            ],
            "repeated": 1,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a79a000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff938d6000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95474000"
              },
              {
                "name": "ModuleName",
                "value": "ntmarta.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92275000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93318000"
              },
              {
                "name": "ModuleName",
                "value": "CoreUIComponents.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\r\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10+P\\x85\\xb6\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95450000"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93840000"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92180000"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93160000"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\textinputframework"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a6e0000"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ntmarta"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95450000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff95456930"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93840000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff938970e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\WinTypes"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92180000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff921aad60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\CoreUIComponents"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93160000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff931e2fe0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\TextInputFramework"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a6e0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8a71e8e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000001"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "9544",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wbemcomn"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8cfe0000"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\CTF\\"
              },
              {
                "name": "Handle",
                "value": "0x00000348"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              },
              {
                "name": "ValueName",
                "value": "EnableAnchorContext"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "9544",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a700000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a700000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a800000"
              },
              {
                "name": "RegionSize",
                "value": "0x00800000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "58"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000348"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a702000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a705000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000370"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97d60000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "IsGUIThread"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d88050"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:2380:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterClassExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d672c0"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "CreateWindowExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d67720"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "DefWindowProcW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ceccb0"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "SetWindowLongPtrW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d6b7c0"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "SetTimer"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d83c70"
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97d60000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2612"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d8bab0"
              }
            ],
            "repeated": 0,
            "id": 795
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "GetWindowLongPtrW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d6f830"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "GetWindowThreadProcessId"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d63500"
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "SendMessageCallbackW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d87e20"
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000037c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-com-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96ff0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-com-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateGuid"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970437e0"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a707000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a800000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2582"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d870e0"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "srand",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "seed",
                "value": "0x6a18c25f"
              }
            ],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:2380:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "IsVailContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-05-28 22:31:59,711",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Input"
              },
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "ResyncResetTime"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              },
              {
                "name": "ValueName",
                "value": "MaxResyncAttempts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a7d4000"
              },
              {
                "name": "ModuleName",
                "value": "textinputframework.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68555d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "iertutil.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x4031c471a94c5fd2"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0xddd559eeb0"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 1,
            "id": 858
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 859
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#32512"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#22"
              },
              {
                "name": "Name",
                "value": "#32512"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msctf.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97f00000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\MSCTF.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "2404",
            "caller": "0x7ff726af04ab",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "9544",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 865
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "9544",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-05-28 22:31:59,727",
            "thread_id": "9544",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 867
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9544",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 869
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2541"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d94230"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 873
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "PostMessageW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d81110"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010626"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "547"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 0,
            "id": 877
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "547"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 1,
            "id": 879
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": ""
              },
              {
                "name": "Ordinal",
                "value": "2613"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d83de0"
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93920000"
              },
              {
                "name": "ModuleName",
                "value": "CoreMessaging.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a709000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aefd55",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a70a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685564000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 890
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685566000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000003d0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x2b6855572c0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "9668"
              },
              {
                "name": "ProcessId",
                "value": "2380"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9668",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9668",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x2b6855572c0"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68556c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00015000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 895
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9680",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9680",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x2b6854f0b50"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9680",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003b4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9684",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 899
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9684",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x2b6854f0b50"
              }
            ],
            "repeated": 0,
            "id": 900
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685581000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9684",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003f0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "9684",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68558e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685566000"
              },
              {
                "name": "RegionSize",
                "value": "0x00014000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685581000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 905
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685581000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              },
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback"
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003f4"
              },
              {
                "name": "SubKey",
                "value": "MS Shell Dlg"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-05-28 22:31:59,743",
            "thread_id": "2404",
            "caller": "0x7ff726aeff19",
            "parentcaller": "0x7ff726af00fd",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 909
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010626"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 2,
            "id": 912
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010626"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 913
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 914
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b686ea9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "548"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 0,
            "id": 916
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "549"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 1,
            "id": 918
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "549"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-05-28 22:31:59,758",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 921
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "550"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetCursorPos",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "x",
                "value": "550"
              },
              {
                "name": "y",
                "value": "687"
              }
            ],
            "repeated": 0,
            "id": 924
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 926
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-05-28 22:31:59,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0xddd559f6d0"
              },
              {
                "name": "EventName",
                "value": "Local\\1ImmersiveFocusTrackingActiveEvent"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010626"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-05-28 22:31:59,821",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 2,
            "id": 935
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "2404",
            "caller": "0x7ff726af05c5",
            "parentcaller": "0x7ff726af095c",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010626"
              },
              {
                "name": "Message",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-05-28 22:31:59,836",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 937
          },
          {
            "timestamp": "2026-05-28 22:32:00,039",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\fastprox"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 938
          },
          {
            "timestamp": "2026-05-28 22:32:00,039",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 939
          },
          {
            "timestamp": "2026-05-28 22:32:00,039",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-05-28 22:32:00,039",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\amsi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d520000"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-05-28 22:32:00,039",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "amsi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d520000"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-05-28 22:32:00,039",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 943
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96260000"
              }
            ],
            "repeated": 0,
            "id": 944
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files\\Windows Defender\\MpOav"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d4d0000"
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 946
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 948
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 950
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\version"
              },
              {
                "name": "DllBase",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 951
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 952
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\version.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff853a0000"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files\\Windows Defender\\MpOAV.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d4d0000"
              }
            ],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 7,
            "id": 957
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ada5b5",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "\\\\.\\root\\cimv2"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad8c09",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 959
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_OperatingSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fd28000"
              },
              {
                "name": "ModuleName",
                "value": "fastprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 961
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fd28000"
              },
              {
                "name": "ModuleName",
                "value": "fastprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a61000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a61000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{027947E1-D731-11CE-A357-000000000001}"
              },
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000432"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              }
            ],
            "repeated": 0,
            "id": 970
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e6"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xc5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x002\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xdd\\x00\\x00\\x00\\xe0\\xc6\\xbf\\xd5\\xdd\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000432"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 979
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 982
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000432"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 984
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 986
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              }
            ],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 989
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc4\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x002\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xdd\\x00\\x00\\x00p\\xc5\\xbf\\xd5\\xdd\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 991
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000432"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 994
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 995
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 996
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc4\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x002\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xdd\\x00\\x00\\x00p\\xc5\\xbf\\xd5\\xdd\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 997
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000432"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              }
            ],
            "repeated": 0,
            "id": 1001
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e6"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xc2\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x002\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xdd\\x00\\x00\\x00\\xa0\\xc3\\xbf\\xd5\\xdd\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000432"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1010
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1012
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1013
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1014
          },
          {
            "timestamp": "2026-05-28 22:32:00,055",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000432"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1015
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 1018
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              }
            ],
            "repeated": 0,
            "id": 1020
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1021
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xc1\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x002\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xdd\\x00\\x00\\x000\\xc2\\xbf\\xd5\\xdd\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000432"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1026
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xc1\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x002\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xdd\\x00\\x00\\x000\\xc2\\xbf\\xd5\\xdd\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1030
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1031
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000432"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1032
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000432"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 1033
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 1034
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1035
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1036
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc0\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x002\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xdd\\x00\\x00\\x00p\\xc1\\xbf\\xd5\\xdd\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1037
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1038
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000432"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1039
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000432"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1040
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002e6"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1041
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000436"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 1042
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              }
            ],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              }
            ],
            "repeated": 0,
            "id": 1044
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000432"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1046
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              }
            ],
            "repeated": 0,
            "id": 1047
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1048
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1049
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1051
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000042e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1053
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000042e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042a"
              }
            ],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042e"
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1058
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1059
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1060
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1061
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000432"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 1062
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000432"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1063
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1064
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              }
            ],
            "repeated": 0,
            "id": 1065
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000432"
              }
            ],
            "repeated": 0,
            "id": 1066
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1067
          },
          {
            "timestamp": "2026-05-28 22:32:00,071",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1068
          },
          {
            "timestamp": "2026-05-28 22:32:00,133",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1069
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1070
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae4c24",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1071
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1072
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1073
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1074
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1075
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Name, Manufacturer, Model, SystemType, UserName, DaylightInEffect FROM Win32_ComputerSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1076
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1077
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1078
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1079
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1080
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1081
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1082
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1083
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1084
          },
          {
            "timestamp": "2026-05-28 22:32:00,789",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1085
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1086
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1087
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1088
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1089
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1090
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1091
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Caption FROM Win32_PageFileUsage"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1092
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1093
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1094
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1095
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1096
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1097
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1098
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1099
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1100
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1101
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1102
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1103
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1104
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1105
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1106
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1107
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CSDVersion"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1108
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ae4d1d",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1109
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1110
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Caption"
              },
              {
                "name": "Value",
                "value": "Microsoft Windows 10 Pro"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1111
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1112
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "10.0.19045"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1113
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1114
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "BuildNumber"
              },
              {
                "name": "Value",
                "value": "19045"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1115
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1116
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "OtherTypeDescription"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1117
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1118
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad918d",
            "parentcaller": "0x7ff726adbcbc",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1119
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "Microsoft Corporation"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1120
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1121
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT RemainingGracePeriod, ActivationRequired FROM Win32_WindowsProductActivation"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1122
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1123
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1124
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1125
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1126
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1127
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1128
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1129
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1130
          },
          {
            "timestamp": "2026-05-28 22:32:00,805",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1131
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1132
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1133
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1134
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WBEM\\CIMOM"
              },
              {
                "name": "Handle",
                "value": "0x0000040c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM"
              }
            ],
            "repeated": 0,
            "id": 1135
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              },
              {
                "name": "ValueName",
                "value": "EnableObjectValidation"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation"
              }
            ],
            "repeated": 0,
            "id": 1136
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              }
            ],
            "repeated": 0,
            "id": 1137
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1138
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1139
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1140
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1141
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b70",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#30"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1142
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "JOHNS-PC"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1143
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1144
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "ASUS"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1145
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1146
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Model"
              },
              {
                "name": "Value",
                "value": "PRIME B450M-A II"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1147
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1148
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SystemType"
              },
              {
                "name": "Value",
                "value": "x64-based PC"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1149
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ad79c3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 1,
            "id": 1150
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "system",
            "api": "WMI_GetObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ObjectPath",
                "value": "\\\\.\\root\\cimv2:Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1151
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1152
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1153
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1154
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad8df1",
            "parentcaller": "0x7ff726ad7a90",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685599000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1155
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae4e59",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1156
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae4e59",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 1157
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae4e59",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 1158
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae4ee9",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490bf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#38"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1159
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae4f40",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1160
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae4f7a",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "HARDWARE\\DESCRIPTION\\System\\BIOS"
              },
              {
                "name": "Handle",
                "value": "0x0000040c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS"
              }
            ],
            "repeated": 0,
            "id": 1161
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae4fbc",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              },
              {
                "name": "ValueName",
                "value": "SystemSKU"
              },
              {
                "name": "Data",
                "value": "SKU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\SystemSKU"
              }
            ],
            "repeated": 0,
            "id": 1162
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ae5048",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              }
            ],
            "repeated": 0,
            "id": 1163
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "10.0.19045"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1164
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ae5132",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1165
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Name,MaxClockSpeed,NumberOfCores,NumberOfLogicalProcessors FROM Win32_Processor"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1166
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1167
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1168
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1169
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1170
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1171
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855b3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1172
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1173
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1174
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1175
          },
          {
            "timestamp": "2026-05-28 22:32:01,149",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1176
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1177
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1178
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1179
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "Intel Core Processor (Skylake, IBRS)"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1180
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1181
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726adc11b",
            "parentcaller": "0x7ff726adc444",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a70c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1182
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "MaxClockSpeed"
              },
              {
                "name": "Value",
                "value": "3686"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1183
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1184
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "NumberOfCores"
              },
              {
                "name": "Value",
                "value": "6"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1185
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1186
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "NumberOfLogicalProcessors"
              },
              {
                "name": "Value",
                "value": "6"
              },
              {
                "name": "Class",
                "value": "Win32_Processor"
              }
            ],
            "repeated": 0,
            "id": 1187
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1188
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1189
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726ae5254",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1190
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1191
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1192
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1193
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1194
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Manufacturer, Version, SMBIOSPresent, SMBIOSBIOSVersion, ReleaseDate, SMBIOSMajorVersion, SMBIOSMinorVersion, BIOSVersion FROM Win32_BIOS"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1195
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1196
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1197
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1198
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1199
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1200
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1201
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1202
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1203
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1204
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1205
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1206
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1207
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1208
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1209
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1210
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSPresent"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1211
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae52e3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1212
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSBIOSVersion"
              },
              {
                "name": "Value",
                "value": "3603"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1213
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ae5328",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1214
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5365",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b70",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#30"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1215
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae537b",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1216
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Manufacturer"
              },
              {
                "name": "Value",
                "value": "American Megatrends Inc."
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1217
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1218
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSBIOSVersion"
              },
              {
                "name": "Value",
                "value": "3603"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1219
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1220
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad76fa",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ReleaseDate"
              },
              {
                "name": "Value",
                "value": "20211105000000.000000+000"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1221
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad771e",
            "parentcaller": "0x7ff726adb3a6",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1222
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSMajorVersion"
              },
              {
                "name": "Value",
                "value": "2"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1223
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1224
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SMBIOSMinorVersion"
              },
              {
                "name": "Value",
                "value": "8"
              },
              {
                "name": "Class",
                "value": "Win32_BIOS"
              }
            ],
            "repeated": 0,
            "id": 1225
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726adb794",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1226
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1227
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1228
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "HARDWARE\\DESCRIPTION\\System\\BIOS"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS"
              }
            ],
            "repeated": 0,
            "id": 1229
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              },
              {
                "name": "ValueName",
                "value": "ECFirmwareMajorRelease"
              },
              {
                "name": "Data",
                "value": "255"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMajorRelease"
              }
            ],
            "repeated": 0,
            "id": 1230
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae55f8",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              }
            ],
            "repeated": 0,
            "id": 1231
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1232
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1233
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "HARDWARE\\DESCRIPTION\\System\\BIOS"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS"
              }
            ],
            "repeated": 0,
            "id": 1234
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              },
              {
                "name": "ValueName",
                "value": "ECFirmwareMinorRelease"
              },
              {
                "name": "Data",
                "value": "255"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMinorRelease"
              }
            ],
            "repeated": 0,
            "id": 1235
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5648",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              }
            ],
            "repeated": 0,
            "id": 1236
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5678",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b90",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#32"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1237
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae574c",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1238
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae57ab",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "90"
              }
            ],
            "repeated": 0,
            "id": 1239
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae57d9",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490ce0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#2051"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1240
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT Manufacturer, Product, Version FROM Win32_BaseBoard"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1241
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1242
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1243
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1244
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1245
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1246
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1247
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1248
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1249
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1250
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1251
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1252
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1253
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1254
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1255
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1256
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae589d",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b90",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#32"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1257
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae5900",
            "parentcaller": "0x7ff726ada7a1",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "75"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1258
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae598a",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#48"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1259
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2d1a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490bf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#38"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1260
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2d74",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1261
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2d8a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490bf0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#38"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1262
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2de4",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1263
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2e1f",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\CurrentControlSet\\Control\\SecureBoot\\State"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecureBoot\\State"
              }
            ],
            "repeated": 0,
            "id": 1264
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2ebf",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c00",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#47"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1265
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2f96",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1266
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2f96",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\fveapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1267
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2f96",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff8d860000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\fveapi.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1268
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fb8",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveGetSecureBootBindingState"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d889060"
              }
            ],
            "repeated": 0,
            "id": 1269
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1270
          },
          {
            "timestamp": "2026-05-28 22:32:01,164",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 1271
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1272
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610d4"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x10\\x00\"\\x00\\x10\\x00\\x12\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x002\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1273
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 1274
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\SEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1275
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000424"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\HEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1276
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\.\\C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 1277
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1278
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000430"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1279
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1280
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x18\r\\x8f\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1281
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1282
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000430"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1283
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1284
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855b8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1285
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000041c"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561083"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc2\"7\\xcd\\xf1\\xee\\xdc\\x01,\\x00\\x08\\x00\n\\x00\\x01\\x00\\x00\\x00\\x00\\x00v#\\x17\\x85TI\\xa831\\xfb6w\\xd0\\x15\\x87\\xaf\\xe4R\\x821\\x85\\x83k6\\^!\\x88\\xeb#;\\xf9\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1286
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software"
              },
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software"
              }
            ],
            "repeated": 0,
            "id": 1287
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System"
              },
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System"
              }
            ],
            "repeated": 0,
            "id": 1288
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1289
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 1290
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 1291
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1292
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 1293
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1294
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1295
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1296
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1297
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1298
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1299
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "imagehlp.dll"
              }
            ],
            "repeated": 0,
            "id": 1300
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000440"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001d000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1301
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98577000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1302
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1303
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1304
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1305
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1306
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1307
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1308
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 1309
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1310
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1311
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1312
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 1313
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 1314
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\imagehlp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff985623b0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1315
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\tbs"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8e465fa0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1316
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1317
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1318
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0000000",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE"
              },
              {
                "name": "FileName",
                "value": "\\??\\TPM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 1319
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": false,
            "return": "0xffffffffc0000008",
            "pretty_return": "INVALID_HANDLE",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1320
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 1321
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 1322
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 1323
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae2fd2",
            "parentcaller": "0x7ff726ae59d7",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1324
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae303b",
            "parentcaller": "0x7ff726ae59d7",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#48"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1325
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 1326
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              }
            ],
            "repeated": 0,
            "id": 1327
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              }
            ],
            "repeated": 0,
            "id": 1328
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1329
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 1330
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1331
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1332
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1333
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 1334
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 1335
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 1336
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1337
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1338
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ae304a",
            "parentcaller": "0x7ff726ae59d7",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 1339
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1340
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "WindowsDirectory"
              },
              {
                "name": "Value",
                "value": "C:\\Windows"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1341
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1342
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SystemDirectory"
              },
              {
                "name": "Value",
                "value": "C:\\Windows\\system32"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1343
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1344
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "BootDevice"
              },
              {
                "name": "Value",
                "value": "\\Device\\HarddiskVolume1"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1345
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1346
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Locale"
              },
              {
                "name": "Value",
                "value": "0409"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1347
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adb538",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1348
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x2b689000001",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "winnlsres.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1349
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b6890004e8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x2b689000001"
              },
              {
                "name": "Type",
                "value": "#10"
              },
              {
                "name": "Name",
                "value": "#1"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1350
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b6890008b8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x2b689000001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b6890004e8"
              }
            ],
            "repeated": 0,
            "id": 1351
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b6890004f8",
            "arguments": [
              {
                "name": "Module",
                "value": "0x2b689000001"
              },
              {
                "name": "Type",
                "value": "#10"
              },
              {
                "name": "Name",
                "value": "#2"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1352
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b689003100",
            "arguments": [
              {
                "name": "Module",
                "value": "0x2b689000001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b6890004f8"
              }
            ],
            "repeated": 0,
            "id": 1353
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "SizeofResource",
            "status": true,
            "return": "0x00001c20",
            "arguments": [
              {
                "name": "ModuleHandle",
                "value": "0x2b689000001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b6890004f8"
              }
            ],
            "repeated": 0,
            "id": 1354
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b689011108",
            "arguments": [
              {
                "name": "Module",
                "value": "0x2b689000001"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#3"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1355
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726adb571",
            "parentcaller": "0x7ff726adc1f6",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x2b689011b4c",
            "arguments": [
              {
                "name": "Module",
                "value": "0x2b689000001"
              },
              {
                "name": "ResourceInfo",
                "value": "0x2b689011108"
              }
            ],
            "repeated": 0,
            "id": 1356
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SystemDirectory"
              },
              {
                "name": "Value",
                "value": "C:\\Windows\\system32"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1357
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726ad946a",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1358
          },
          {
            "timestamp": "2026-05-28 22:32:01,180",
            "thread_id": "9544",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "system",
            "api": "WMI_GetObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ObjectPath",
                "value": "\\\\.\\root\\cimv2:CIM_DataFile.Name='C:\\Windows\\system32\\hal.dll'"
              }
            ],
            "repeated": 0,
            "id": 1359
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1360
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1361
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7001",
            "parentcaller": "0x7ff726ad88b7",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1362
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1363
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726adaced",
            "parentcaller": "0x7ff726adc397",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a70d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1364
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "10.0.19041.3636"
              },
              {
                "name": "Class",
                "value": "CIM_DataFile"
              }
            ],
            "repeated": 0,
            "id": 1365
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1366
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1367
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UserName"
              },
              {
                "name": "Value",
                "value": "JOHNS-PC\\admin"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1368
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1369
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DaylightInEffect"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1370
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae5b58",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1371
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_TimeZone"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1372
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1373
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1374
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1375
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1376
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1377
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1378
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1379
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1380
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1381
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1382
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1383
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1384
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1385
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1386
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1387
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1388
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DaylightName"
              },
              {
                "name": "Value",
                "value": "Eastern Daylight Time"
              },
              {
                "name": "Class",
                "value": "Win32_TimeZone"
              }
            ],
            "repeated": 0,
            "id": 1389
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1390
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c26",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1391
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c42",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "GetPhysicallyInstalledSystemMemory",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TotalMemoryInKilobytes",
                "value": "8388608"
              }
            ],
            "repeated": 0,
            "id": 1392
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1393
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "PROPSYS.dll"
              }
            ],
            "repeated": 0,
            "id": 1394
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              }
            ],
            "repeated": 0,
            "id": 1395
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1396
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              }
            ],
            "repeated": 0,
            "id": 1397
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000044c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91eb0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000f6000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1398
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1399
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1400
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1401
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1402
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6d000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1403
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6c000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1404
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 1405
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 1406
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f6c000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1407
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91eb0000"
              }
            ],
            "repeated": 0,
            "id": 1408
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff91eb0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "propsys.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000022"
              }
            ],
            "repeated": 0,
            "id": 1409
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\propsys"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91eb0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff91ef2b20"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1410
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1411
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1412
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 1413
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\PROPSYS.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1414
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000450"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\propsys.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 1415
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000454"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689020000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfe210"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1416
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ae5c94",
            "parentcaller": "0x7ff726ada7a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1417
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT TotalPhysicalMemory FROM Win32_LogicalMemoryConfiguration"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1418
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1419
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1420
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1421
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1422
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1423
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1424
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1425
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1426
          },
          {
            "timestamp": "2026-05-28 22:32:01,227",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1427
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1428
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1429
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1430
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1431
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1432
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1433
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1434
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT TotalPhysicalMemory FROM Win32_ComputerSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1435
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1436
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1437
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1438
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1439
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1440
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1441
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1442
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1443
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1444
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1445
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1446
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1447
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1448
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1449
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1450
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7851",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TotalPhysicalMemory"
              },
              {
                "name": "Value",
                "value": "8589389824"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 1451
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7871",
            "parentcaller": "0x7ff726ae5dcd",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1452
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ae5e9a",
            "parentcaller": "0x7ff726ada7a1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1453
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "FreePhysicalMemory"
              },
              {
                "name": "Value",
                "value": "5190252"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1454
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1455
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "TotalVirtualMemorySize"
              },
              {
                "name": "Value",
                "value": "10354156"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1456
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1457
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "FreeVirtualMemory"
              },
              {
                "name": "Value",
                "value": "7245120"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1458
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1459
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7901",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SizeStoredInPagingFiles"
              },
              {
                "name": "Value",
                "value": "1966080"
              },
              {
                "name": "Class",
                "value": "Win32_OperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1460
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7921",
            "parentcaller": "0x7ff726adb728",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 3,
            "id": 1461
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1462
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7341",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Caption"
              },
              {
                "name": "Value",
                "value": "C:\\pagefile.sys"
              },
              {
                "name": "Class",
                "value": "Win32_PageFileUsage"
              }
            ],
            "repeated": 0,
            "id": 1463
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad746c",
            "parentcaller": "0x7ff726adbaa3",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1464
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ae2b9c",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c70",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#66"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1465
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ae2bb1",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1466
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ae2bd4",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "202"
              }
            ],
            "repeated": 0,
            "id": 1467
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ae2bf8",
            "parentcaller": "0x7ff726ae5fd2",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#48"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1468
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7fe9",
            "parentcaller": "0x7ff726ae3a6d",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1469
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad7ffe",
            "parentcaller": "0x7ff726ae3a6d",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b00",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#23"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1470
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad8013",
            "parentcaller": "0x7ff726ae3a6d",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1471
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad8b28",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1472
          },
          {
            "timestamp": "2026-05-28 22:32:01,243",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1473
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1474
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad8bbe",
            "parentcaller": "0x7ff726ae3aee",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "\\\\.\\root\\Microsoft\\Windows\\DeviceGuard"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1475
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad8c09",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1476
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT * FROM Win32_DeviceGuard"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 1477
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1478
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1479
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1480
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1481
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1482
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1483
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1484
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1485
          },
          {
            "timestamp": "2026-05-28 22:32:01,258",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1486
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1487
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1488
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1489
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1490
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1491
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1492
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "VirtualizationBasedSecurityStatus"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1493
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae3b33",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1494
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "RequiredSecurityProperties"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1495
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "AvailableSecurityProperties"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1496
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityServicesConfigured"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1497
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityServicesRunning"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1498
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CodeIntegrityPolicyEnforcementStatus"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1499
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae3bed",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1500
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UsermodeCodeIntegrityPolicyEnforcementStatus"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1501
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae3c15",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1502
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7281",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "VirtualMachineIsolation"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1503
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad72a1",
            "parentcaller": "0x7ff726ae3c3d",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 1504
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7144",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "VirtualMachineIsolationProperties"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "Win32_DeviceGuard"
              }
            ],
            "repeated": 0,
            "id": 1505
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae3652",
            "parentcaller": "0x7ff726ae3cba",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c20",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#54"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1506
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad8122",
            "parentcaller": "0x7ff726ae3d30",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1507
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ad8122",
            "parentcaller": "0x7ff726ae3d30",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1508
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae455a",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#60"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1509
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae45b4",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490af0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#22"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1510
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae45df",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1511
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae45df",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "fveapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 1512
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae45df",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff8d860000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "fveapi.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1513
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae461c",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveQueryDeviceEncryptionSupport"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d884b90"
              }
            ],
            "repeated": 0,
            "id": 1514
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1515
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 1516
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1517
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000468"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610d4"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x10\\x00\"\\x00\\x10\\x00\\x12\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x002\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1518
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 1519
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\SEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1520
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\2\\HEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1521
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\.\\C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 1522
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1523
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1524
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 1525
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000468"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x18\r\\x8f\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1526
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1527
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000438"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1528
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1529
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1530
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000468"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561083"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00D\\x86G\\xcd\\xf1\\xee\\xdc\\x01,\\x00\\x08\\x00\n\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\xe9\\x1f\\xc9\\xbb\\xc0\\xd2\\x9c\\x86\\x9aI\\xe3\\x0b\\xb7/Wl\\x1a5\\xc2\\xc7\\xd3\\xceuK\\x1f!\\x9e\\x118\\x8e\\x1f_\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1531
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1532
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 1533
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 1534
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000468"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610c8"
              },
              {
                "name": "InBuffer",
                "value": "\\x08\\x00\\x01\\x00\n\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1535
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x82000000",
                "pretty_value": "0x82000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 0,
            "id": 1536
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x82000000",
                "pretty_value": "0x82000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\"
              }
            ],
            "repeated": 0,
            "id": 1537
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1538
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000438"
              },
              {
                "name": "ValueName",
                "value": "PortableOperatingSystem"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\PortableOperatingSystem"
              }
            ],
            "repeated": 0,
            "id": 1539
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1540
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1541
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "66"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x00"
              }
            ],
            "repeated": 0,
            "id": 1542
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": false,
            "return": "0xffffffffc0000225",
            "pretty_return": "NOT_FOUND",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "166"
              }
            ],
            "repeated": 0,
            "id": 1543
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1544
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1545
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\HSTI"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\HSTI"
              }
            ],
            "repeated": 0,
            "id": 1546
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "ValueName",
                "value": "HSTIVerificationRequired"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\HSTI\\HSTIVerificationRequired"
              }
            ],
            "repeated": 0,
            "id": 1547
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1548
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1549
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000438"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "13"
              },
              {
                "name": "MaxValueNameLength",
                "value": "35"
              },
              {
                "name": "MaxValueLength",
                "value": "28"
              }
            ],
            "repeated": 0,
            "id": 1550
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1551
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1552
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000438"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1553
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1554
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1555
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "CardBus Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\CardBus Bridge"
              }
            ],
            "repeated": 0,
            "id": 1556
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "CardBus Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0607"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\CardBus Bridge"
              }
            ],
            "repeated": 0,
            "id": 1557
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "EISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1558
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "EISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0602"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1559
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "EISA Plug and Play bus"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1560
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "EISA Plug and Play bus"
              },
              {
                "name": "Data",
                "value": "PNP0A01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\EISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1561
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "IEEE 1394"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "28"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\IEEE 1394"
              }
            ],
            "repeated": 0,
            "id": 1562
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "IEEE 1394"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0C0010"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\IEEE 1394"
              }
            ],
            "repeated": 0,
            "id": 1563
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "ISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1564
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "ISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0601"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1565
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1566
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus"
              },
              {
                "name": "Data",
                "value": "PNP0A00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus"
              }
            ],
            "repeated": 0,
            "id": 1567
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus with VL slots"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus with VL slots"
              }
            ],
            "repeated": 0,
            "id": 1568
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "ISA Plug and Play bus with VL slots"
              },
              {
                "name": "Data",
                "value": "PNP0A04"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ISA Plug and Play bus with VL slots"
              }
            ],
            "repeated": 0,
            "id": 1569
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "PCI bus"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI bus"
              }
            ],
            "repeated": 0,
            "id": 1570
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "PCI bus"
              },
              {
                "name": "Data",
                "value": "PNP0A03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI bus"
              }
            ],
            "repeated": 0,
            "id": 1571
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1572
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Data",
                "value": "PNP0A08"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1573
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "PCI-to-PCI Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1574
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "PCI-to-PCI Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0604"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1575
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "PCMCIA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCMCIA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1576
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "PCMCIA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0605"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\PCMCIA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1577
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "SemiTransparent PCI-to-PCI Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\SemiTransparent PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1578
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "SemiTransparent PCI-to-PCI Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0609"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\SemiTransparent PCI-to-PCI Bridge"
              }
            ],
            "repeated": 0,
            "id": 1579
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "ThunderBolt"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "24"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ThunderBolt"
              }
            ],
            "repeated": 0,
            "id": 1580
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "ThunderBolt"
              },
              {
                "name": "Data",
                "value": "PCI\\CC_0C0A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\UnallowedBuses\\ThunderBolt"
              }
            ],
            "repeated": 0,
            "id": 1581
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1582
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1583
          },
          {
            "timestamp": "2026-05-28 22:32:01,274",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1584
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1585
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000438"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "172"
              },
              {
                "name": "MaxValueNameLength",
                "value": "78"
              },
              {
                "name": "MaxValueLength",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 1586
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1587
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1588
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000438"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1589
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855ca000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1590
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1591
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1592
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "BayTrail ISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\BayTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1593
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "ValueName",
                "value": "BayTrail ISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_0F1C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\BayTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1594
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 1"
              }
            ],
            "repeated": 0,
            "id": 1595
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9CC3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 1"
              }
            ],
            "repeated": 0,
            "id": 1596
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 2"
              }
            ],
            "repeated": 0,
            "id": 1597
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9CC7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 2"
              }
            ],
            "repeated": 0,
            "id": 1598
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 3"
              }
            ],
            "repeated": 0,
            "id": 1599
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "ValueName",
                "value": "Broadwell LPC 3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9CC9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell LPC 3"
              }
            ],
            "repeated": 0,
            "id": 1600
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 1"
              }
            ],
            "repeated": 0,
            "id": 1601
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C90"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 1"
              }
            ],
            "repeated": 0,
            "id": 1602
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 2"
              }
            ],
            "repeated": 0,
            "id": 1603
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C92"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 2"
              }
            ],
            "repeated": 0,
            "id": 1604
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 3"
              }
            ],
            "repeated": 0,
            "id": 1605
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C94"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 3"
              }
            ],
            "repeated": 0,
            "id": 1606
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 4"
              }
            ],
            "repeated": 0,
            "id": 1607
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C96"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 4"
              }
            ],
            "repeated": 0,
            "id": 1608
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 5"
              }
            ],
            "repeated": 0,
            "id": 1609
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C98"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 5"
              }
            ],
            "repeated": 0,
            "id": 1610
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 6"
              }
            ],
            "repeated": 0,
            "id": 1611
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "ValueName",
                "value": "Broadwell Root Port 6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C9A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Broadwell Root Port 6"
              }
            ],
            "repeated": 0,
            "id": 1612
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D80"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D80"
              }
            ],
            "repeated": 0,
            "id": 1613
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D80"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D80"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D80"
              }
            ],
            "repeated": 0,
            "id": 1614
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D81"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D81"
              }
            ],
            "repeated": 0,
            "id": 1615
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D81"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D81"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D81"
              }
            ],
            "repeated": 0,
            "id": 1616
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D82"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D82"
              }
            ],
            "repeated": 0,
            "id": 1617
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D82"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D82"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D82"
              }
            ],
            "repeated": 0,
            "id": 1618
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D83"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D83"
              }
            ],
            "repeated": 0,
            "id": 1619
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D83"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D83"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D83"
              }
            ],
            "repeated": 0,
            "id": 1620
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D84"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D84"
              }
            ],
            "repeated": 0,
            "id": 1621
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D84"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D84"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D84"
              }
            ],
            "repeated": 0,
            "id": 1622
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D85"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D85"
              }
            ],
            "repeated": 0,
            "id": 1623
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D85"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D85"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D85"
              }
            ],
            "repeated": 0,
            "id": 1624
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D86"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D86"
              }
            ],
            "repeated": 0,
            "id": 1625
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "16"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D86"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D86"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D86"
              }
            ],
            "repeated": 0,
            "id": 1626
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D87"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D87"
              }
            ],
            "repeated": 0,
            "id": 1627
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "17"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D87"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D87"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D87"
              }
            ],
            "repeated": 0,
            "id": 1628
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D88"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D88"
              }
            ],
            "repeated": 0,
            "id": 1629
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "18"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D88"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D88"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D88"
              }
            ],
            "repeated": 0,
            "id": 1630
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D89"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D89"
              }
            ],
            "repeated": 0,
            "id": 1631
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "19"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D89"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D89"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D89"
              }
            ],
            "repeated": 0,
            "id": 1632
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8A"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8A"
              }
            ],
            "repeated": 0,
            "id": 1633
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "20"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8A"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8A"
              }
            ],
            "repeated": 0,
            "id": 1634
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8B"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8B"
              }
            ],
            "repeated": 0,
            "id": 1635
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "21"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8B"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8B"
              }
            ],
            "repeated": 0,
            "id": 1636
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8C"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8C"
              }
            ],
            "repeated": 0,
            "id": 1637
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "22"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8C"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8C"
              }
            ],
            "repeated": 0,
            "id": 1638
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8D"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8D"
              }
            ],
            "repeated": 0,
            "id": 1639
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "23"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8D"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8D"
              }
            ],
            "repeated": 0,
            "id": 1640
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8E"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8E"
              }
            ],
            "repeated": 0,
            "id": 1641
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "24"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8E"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8E"
              }
            ],
            "repeated": 0,
            "id": 1642
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8F"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8F"
              }
            ],
            "repeated": 0,
            "id": 1643
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "25"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D8F"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D8F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D8F"
              }
            ],
            "repeated": 0,
            "id": 1644
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D90"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D90"
              }
            ],
            "repeated": 0,
            "id": 1645
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "26"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D90"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D90"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D90"
              }
            ],
            "repeated": 0,
            "id": 1646
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D91"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D91"
              }
            ],
            "repeated": 0,
            "id": 1647
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "27"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D91"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D91"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D91"
              }
            ],
            "repeated": 0,
            "id": 1648
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D92"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D92"
              }
            ],
            "repeated": 0,
            "id": 1649
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "28"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D92"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D92"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D92"
              }
            ],
            "repeated": 0,
            "id": 1650
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D93"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D93"
              }
            ],
            "repeated": 0,
            "id": 1651
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "29"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D93"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D93"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D93"
              }
            ],
            "repeated": 0,
            "id": 1652
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D94"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D94"
              }
            ],
            "repeated": 0,
            "id": 1653
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "30"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D94"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D94"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D94"
              }
            ],
            "repeated": 0,
            "id": 1654
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D95"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D95"
              }
            ],
            "repeated": 0,
            "id": 1655
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "31"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D95"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D95"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D95"
              }
            ],
            "repeated": 0,
            "id": 1656
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D96"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D96"
              }
            ],
            "repeated": 0,
            "id": 1657
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "32"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D96"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D96"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D96"
              }
            ],
            "repeated": 0,
            "id": 1658
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D97"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D97"
              }
            ],
            "repeated": 0,
            "id": 1659
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "33"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D97"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D97"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D97"
              }
            ],
            "repeated": 0,
            "id": 1660
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D98"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D98"
              }
            ],
            "repeated": 0,
            "id": 1661
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "34"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D98"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D98"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D98"
              }
            ],
            "repeated": 0,
            "id": 1662
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D99"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D99"
              }
            ],
            "repeated": 0,
            "id": 1663
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "35"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D99"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D99"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D99"
              }
            ],
            "repeated": 0,
            "id": 1664
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9A"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9A"
              }
            ],
            "repeated": 0,
            "id": 1665
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "36"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9A"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9A"
              }
            ],
            "repeated": 0,
            "id": 1666
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9B"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9B"
              }
            ],
            "repeated": 0,
            "id": 1667
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "37"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9B"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9B"
              }
            ],
            "repeated": 0,
            "id": 1668
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9C"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9C"
              }
            ],
            "repeated": 0,
            "id": 1669
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "38"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9C"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9C"
              }
            ],
            "repeated": 0,
            "id": 1670
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9D"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9D"
              }
            ],
            "repeated": 0,
            "id": 1671
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "39"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9D"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9D"
              }
            ],
            "repeated": 0,
            "id": 1672
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9E"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9E"
              }
            ],
            "repeated": 0,
            "id": 1673
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "40"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9E"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9E"
              }
            ],
            "repeated": 0,
            "id": 1674
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9F"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9F"
              }
            ],
            "repeated": 0,
            "id": 1675
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "41"
              },
              {
                "name": "ValueName",
                "value": "CannonLake LPC Controller/eSPI Controller - 9D9F"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D9F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake LPC Controller/eSPI Controller - 9D9F"
              }
            ],
            "repeated": 0,
            "id": 1676
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB0"
              }
            ],
            "repeated": 0,
            "id": 1677
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "42"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB0"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB0"
              }
            ],
            "repeated": 0,
            "id": 1678
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB1"
              }
            ],
            "repeated": 0,
            "id": 1679
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "43"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB1"
              }
            ],
            "repeated": 0,
            "id": 1680
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB2"
              }
            ],
            "repeated": 0,
            "id": 1681
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "44"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB2"
              }
            ],
            "repeated": 0,
            "id": 1682
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB3"
              }
            ],
            "repeated": 0,
            "id": 1683
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "45"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB3"
              }
            ],
            "repeated": 0,
            "id": 1684
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB4"
              }
            ],
            "repeated": 0,
            "id": 1685
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "46"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB4"
              }
            ],
            "repeated": 0,
            "id": 1686
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB5"
              }
            ],
            "repeated": 0,
            "id": 1687
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "47"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB5"
              }
            ],
            "repeated": 0,
            "id": 1688
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB6"
              }
            ],
            "repeated": 0,
            "id": 1689
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "48"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB6"
              }
            ],
            "repeated": 0,
            "id": 1690
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB7"
              }
            ],
            "repeated": 0,
            "id": 1691
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "49"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB7"
              }
            ],
            "repeated": 0,
            "id": 1692
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB8"
              }
            ],
            "repeated": 0,
            "id": 1693
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "50"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB8"
              }
            ],
            "repeated": 0,
            "id": 1694
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB9"
              }
            ],
            "repeated": 0,
            "id": 1695
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "51"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DB9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DB9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DB9"
              }
            ],
            "repeated": 0,
            "id": 1696
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBA"
              }
            ],
            "repeated": 0,
            "id": 1697
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "52"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBA"
              }
            ],
            "repeated": 0,
            "id": 1698
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBB"
              }
            ],
            "repeated": 0,
            "id": 1699
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "53"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBB"
              }
            ],
            "repeated": 0,
            "id": 1700
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBC"
              }
            ],
            "repeated": 0,
            "id": 1701
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "54"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBC"
              }
            ],
            "repeated": 0,
            "id": 1702
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBD"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBD"
              }
            ],
            "repeated": 0,
            "id": 1703
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "55"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBD"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBD"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBD"
              }
            ],
            "repeated": 0,
            "id": 1704
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBE"
              }
            ],
            "repeated": 0,
            "id": 1705
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "56"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBE"
              }
            ],
            "repeated": 0,
            "id": 1706
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBF"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBF"
              }
            ],
            "repeated": 0,
            "id": 1707
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "57"
              },
              {
                "name": "ValueName",
                "value": "CannonLake PCI Express Root Port - 9DBF"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9DBF"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CannonLake PCI Express Root Port - 9DBF"
              }
            ],
            "repeated": 0,
            "id": 1708
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail ISA Bridge"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1709
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "58"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail ISA Bridge"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_229C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail ISA Bridge"
              }
            ],
            "repeated": 0,
            "id": 1710
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail Root Port"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail Root Port"
              }
            ],
            "repeated": 0,
            "id": 1711
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "59"
              },
              {
                "name": "ValueName",
                "value": "CherryTrail Root Port"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_22C8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\CherryTrail Root Port"
              }
            ],
            "repeated": 0,
            "id": 1712
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "ValueName",
                "value": "Geminilake LPC - 31E8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake LPC - 31E8"
              }
            ],
            "repeated": 0,
            "id": 1713
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "60"
              },
              {
                "name": "ValueName",
                "value": "Geminilake LPC - 31E8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31E8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake LPC - 31E8"
              }
            ],
            "repeated": 0,
            "id": 1714
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D6"
              }
            ],
            "repeated": 0,
            "id": 1715
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "61"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D6"
              }
            ],
            "repeated": 0,
            "id": 1716
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D7"
              }
            ],
            "repeated": 0,
            "id": 1717
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "62"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D7"
              }
            ],
            "repeated": 0,
            "id": 1718
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D8"
              }
            ],
            "repeated": 0,
            "id": 1719
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "63"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D8"
              }
            ],
            "repeated": 0,
            "id": 1720
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D9"
              }
            ],
            "repeated": 0,
            "id": 1721
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "64"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31D9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31D9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31D9"
              }
            ],
            "repeated": 0,
            "id": 1722
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DA"
              }
            ],
            "repeated": 0,
            "id": 1723
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "65"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31DA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DA"
              }
            ],
            "repeated": 0,
            "id": 1724
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DB"
              }
            ],
            "repeated": 0,
            "id": 1725
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "66"
              },
              {
                "name": "ValueName",
                "value": "Geminilake PCIe - B 0 - 31DB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_31DB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Geminilake PCIe - B 0 - 31DB"
              }
            ],
            "repeated": 0,
            "id": 1726
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "ValueName",
                "value": "Haswell LPC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Haswell LPC"
              }
            ],
            "repeated": 0,
            "id": 1727
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "67"
              },
              {
                "name": "ValueName",
                "value": "Haswell LPC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9C43"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Haswell LPC"
              }
            ],
            "repeated": 0,
            "id": 1728
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "68"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              }
            ],
            "repeated": 0,
            "id": 1729
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "68"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (B250) - A2C8"
              }
            ],
            "repeated": 0,
            "id": 1730
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "69"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              }
            ],
            "repeated": 0,
            "id": 1731
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "69"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (H270) - A2C4"
              }
            ],
            "repeated": 0,
            "id": 1732
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "70"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              }
            ],
            "repeated": 0,
            "id": 1733
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "70"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q250) - A2C7"
              }
            ],
            "repeated": 0,
            "id": 1734
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "71"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              }
            ],
            "repeated": 0,
            "id": 1735
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "71"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Q270) - A2C6"
              }
            ],
            "repeated": 0,
            "id": 1736
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "72"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              }
            ],
            "repeated": 0,
            "id": 1737
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "72"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CF"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (SuperSKU Server) - A2CF"
              }
            ],
            "repeated": 0,
            "id": 1738
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "73"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              }
            ],
            "repeated": 0,
            "id": 1739
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "73"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D2"
              }
            ],
            "repeated": 0,
            "id": 1740
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "74"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              }
            ],
            "repeated": 0,
            "id": 1741
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "74"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (X299) - A2D3"
              }
            ],
            "repeated": 0,
            "id": 1742
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "75"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              }
            ],
            "repeated": 0,
            "id": 1743
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "75"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z270) - A2C5"
              }
            ],
            "repeated": 0,
            "id": 1744
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "76"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              }
            ],
            "repeated": 0,
            "id": 1745
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "76"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2C9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) 200 Series Chipset Family LPC Controller (Z370) - A2C9"
              }
            ],
            "repeated": 0,
            "id": 1746
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "77"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              }
            ],
            "repeated": 0,
            "id": 1747
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "77"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AE8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor LPC Controller/eSPI Controller - 5AE8"
              }
            ],
            "repeated": 0,
            "id": 1748
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "78"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              }
            ],
            "repeated": 0,
            "id": 1749
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "78"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD6"
              }
            ],
            "repeated": 0,
            "id": 1750
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "79"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              }
            ],
            "repeated": 0,
            "id": 1751
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "79"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD7"
              }
            ],
            "repeated": 0,
            "id": 1752
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "80"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              }
            ],
            "repeated": 0,
            "id": 1753
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "80"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD8"
              }
            ],
            "repeated": 0,
            "id": 1754
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "81"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              }
            ],
            "repeated": 0,
            "id": 1755
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "81"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5AD9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5AD9"
              }
            ],
            "repeated": 0,
            "id": 1756
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "82"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              }
            ],
            "repeated": 0,
            "id": 1757
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "82"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5ADA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADA"
              }
            ],
            "repeated": 0,
            "id": 1758
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "83"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              }
            ],
            "repeated": 0,
            "id": 1759
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "83"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_5ADB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) Celeron(R)/Pentium(R) Processor PCI Express Root Port - 5ADB"
              }
            ],
            "repeated": 0,
            "id": 1760
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "84"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CA"
              }
            ],
            "repeated": 0,
            "id": 1761
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "84"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CA"
              }
            ],
            "repeated": 0,
            "id": 1762
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "85"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CB"
              }
            ],
            "repeated": 0,
            "id": 1763
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "85"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CB"
              }
            ],
            "repeated": 0,
            "id": 1764
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "86"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CC"
              }
            ],
            "repeated": 0,
            "id": 1765
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "86"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CC"
              }
            ],
            "repeated": 0,
            "id": 1766
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "87"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CD"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CD"
              }
            ],
            "repeated": 0,
            "id": 1767
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "87"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2CD"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CD"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2CD"
              }
            ],
            "repeated": 0,
            "id": 1768
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "88"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D0"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D0"
              }
            ],
            "repeated": 0,
            "id": 1769
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "88"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D0"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D0"
              }
            ],
            "repeated": 0,
            "id": 1770
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "89"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D1"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D1"
              }
            ],
            "repeated": 0,
            "id": 1771
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "89"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D1"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D1"
              }
            ],
            "repeated": 0,
            "id": 1772
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "90"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D4"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D4"
              }
            ],
            "repeated": 0,
            "id": 1773
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "90"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D4"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D4"
              }
            ],
            "repeated": 0,
            "id": 1774
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "91"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D5"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D5"
              }
            ],
            "repeated": 0,
            "id": 1775
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "91"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D5"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D5"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D5"
              }
            ],
            "repeated": 0,
            "id": 1776
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "92"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D6"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D6"
              }
            ],
            "repeated": 0,
            "id": 1777
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "92"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D6"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D6"
              }
            ],
            "repeated": 0,
            "id": 1778
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "93"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D7"
              }
            ],
            "repeated": 0,
            "id": 1779
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "93"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D7"
              }
            ],
            "repeated": 0,
            "id": 1780
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "94"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D8"
              }
            ],
            "repeated": 0,
            "id": 1781
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "94"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D8"
              }
            ],
            "repeated": 0,
            "id": 1782
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "95"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D9"
              }
            ],
            "repeated": 0,
            "id": 1783
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "95"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2D9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2D9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2D9"
              }
            ],
            "repeated": 0,
            "id": 1784
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "96"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DA"
              }
            ],
            "repeated": 0,
            "id": 1785
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "96"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DA"
              }
            ],
            "repeated": 0,
            "id": 1786
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "97"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DB"
              }
            ],
            "repeated": 0,
            "id": 1787
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "97"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DB"
              }
            ],
            "repeated": 0,
            "id": 1788
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "98"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DC"
              }
            ],
            "repeated": 0,
            "id": 1789
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "98"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DC"
              }
            ],
            "repeated": 0,
            "id": 1790
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "99"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DD"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DD"
              }
            ],
            "repeated": 0,
            "id": 1791
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "99"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DD"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DD"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DD"
              }
            ],
            "repeated": 0,
            "id": 1792
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "100"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DE"
              }
            ],
            "repeated": 0,
            "id": 1793
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "100"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DE"
              }
            ],
            "repeated": 0,
            "id": 1794
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "101"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DF"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DF"
              }
            ],
            "repeated": 0,
            "id": 1795
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "101"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller - A2DF"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2DF"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller - A2DF"
              }
            ],
            "repeated": 0,
            "id": 1796
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "102"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              }
            ],
            "repeated": 0,
            "id": 1797
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "102"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2CE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) LPC Controller KBP - I Interposer SuperSKU Server - A2CE"
              }
            ],
            "repeated": 0,
            "id": 1798
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "103"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #1 - A290"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #1 - A290"
              }
            ],
            "repeated": 0,
            "id": 1799
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "103"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #1 - A290"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A290"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #1 - A290"
              }
            ],
            "repeated": 0,
            "id": 1800
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "104"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #10 - A299"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #10 - A299"
              }
            ],
            "repeated": 0,
            "id": 1801
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "104"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #10 - A299"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A299"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #10 - A299"
              }
            ],
            "repeated": 0,
            "id": 1802
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "105"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #11 - A29A"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #11 - A29A"
              }
            ],
            "repeated": 0,
            "id": 1803
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "105"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #11 - A29A"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #11 - A29A"
              }
            ],
            "repeated": 0,
            "id": 1804
          },
          {
            "timestamp": "2026-05-28 22:32:01,289",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "106"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #12 - A29B"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #12 - A29B"
              }
            ],
            "repeated": 0,
            "id": 1805
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "106"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #12 - A29B"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #12 - A29B"
              }
            ],
            "repeated": 0,
            "id": 1806
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "107"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #13 - A29C"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #13 - A29C"
              }
            ],
            "repeated": 0,
            "id": 1807
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "107"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #13 - A29C"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #13 - A29C"
              }
            ],
            "repeated": 0,
            "id": 1808
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "108"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #14 - A29D"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #14 - A29D"
              }
            ],
            "repeated": 0,
            "id": 1809
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "108"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #14 - A29D"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #14 - A29D"
              }
            ],
            "repeated": 0,
            "id": 1810
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "109"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #15 - A29E"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #15 - A29E"
              }
            ],
            "repeated": 0,
            "id": 1811
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "109"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #15 - A29E"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #15 - A29E"
              }
            ],
            "repeated": 0,
            "id": 1812
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "110"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #16 - A29F"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #16 - A29F"
              }
            ],
            "repeated": 0,
            "id": 1813
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "110"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #16 - A29F"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A29F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #16 - A29F"
              }
            ],
            "repeated": 0,
            "id": 1814
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "111"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E7"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E7"
              }
            ],
            "repeated": 0,
            "id": 1815
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "111"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E7"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2E7"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E7"
              }
            ],
            "repeated": 0,
            "id": 1816
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "112"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E8"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E8"
              }
            ],
            "repeated": 0,
            "id": 1817
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "112"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E8"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2E8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E8"
              }
            ],
            "repeated": 0,
            "id": 1818
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "113"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E9"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E9"
              }
            ],
            "repeated": 0,
            "id": 1819
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "113"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2E9"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2E9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2E9"
              }
            ],
            "repeated": 0,
            "id": 1820
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "114"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EA"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EA"
              }
            ],
            "repeated": 0,
            "id": 1821
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "114"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EA"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EA"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EA"
              }
            ],
            "repeated": 0,
            "id": 1822
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "115"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EB"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EB"
              }
            ],
            "repeated": 0,
            "id": 1823
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "115"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EB"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EB"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EB"
              }
            ],
            "repeated": 0,
            "id": 1824
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "116"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EC"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EC"
              }
            ],
            "repeated": 0,
            "id": 1825
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "116"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EC"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EC"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EC"
              }
            ],
            "repeated": 0,
            "id": 1826
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "117"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2ED"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2ED"
              }
            ],
            "repeated": 0,
            "id": 1827
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "117"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2ED"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2ED"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2ED"
              }
            ],
            "repeated": 0,
            "id": 1828
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "118"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EE"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EE"
              }
            ],
            "repeated": 0,
            "id": 1829
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "118"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #17 - A2EE"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A2EE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #17 - A2EE"
              }
            ],
            "repeated": 0,
            "id": 1830
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "119"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #2 - A291"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #2 - A291"
              }
            ],
            "repeated": 0,
            "id": 1831
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "119"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #2 - A291"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A291"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #2 - A291"
              }
            ],
            "repeated": 0,
            "id": 1832
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "120"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #3 - A292"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #3 - A292"
              }
            ],
            "repeated": 0,
            "id": 1833
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "120"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #3 - A292"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A292"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #3 - A292"
              }
            ],
            "repeated": 0,
            "id": 1834
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "121"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #4 - A293"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #4 - A293"
              }
            ],
            "repeated": 0,
            "id": 1835
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "121"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #4 - A293"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A293"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #4 - A293"
              }
            ],
            "repeated": 0,
            "id": 1836
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "122"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #5 - A294"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #5 - A294"
              }
            ],
            "repeated": 0,
            "id": 1837
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "122"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #5 - A294"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A294"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #5 - A294"
              }
            ],
            "repeated": 0,
            "id": 1838
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "123"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #6 - A295"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #6 - A295"
              }
            ],
            "repeated": 0,
            "id": 1839
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "123"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #6 - A295"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A295"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #6 - A295"
              }
            ],
            "repeated": 0,
            "id": 1840
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "124"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #7 - A296"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #7 - A296"
              }
            ],
            "repeated": 0,
            "id": 1841
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "124"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #7 - A296"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #7 - A296"
              }
            ],
            "repeated": 0,
            "id": 1842
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "125"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #8 - A297"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #8 - A297"
              }
            ],
            "repeated": 0,
            "id": 1843
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "125"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #8 - A297"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A297"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #8 - A297"
              }
            ],
            "repeated": 0,
            "id": 1844
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "126"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #9 - A298"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #9 - A298"
              }
            ],
            "repeated": 0,
            "id": 1845
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "126"
              },
              {
                "name": "ValueName",
                "value": "Intel(R) PCI Express Root Port #9 - A298"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_A298"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\Intel(R) PCI Express Root Port #9 - A298"
              }
            ],
            "repeated": 0,
            "id": 1846
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "127"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1847
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "127"
              },
              {
                "name": "ValueName",
                "value": "PCI Express Root Complex"
              },
              {
                "name": "Data",
                "value": "PNP0A08"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\PCI Express Root Complex"
              }
            ],
            "repeated": 0,
            "id": 1848
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "128"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 01"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 01"
              }
            ],
            "repeated": 0,
            "id": 1849
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "128"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 01"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D40"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 01"
              }
            ],
            "repeated": 0,
            "id": 1850
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "129"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 02"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 02"
              }
            ],
            "repeated": 0,
            "id": 1851
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "129"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 02"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D41"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 02"
              }
            ],
            "repeated": 0,
            "id": 1852
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "130"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 03"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 03"
              }
            ],
            "repeated": 0,
            "id": 1853
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "130"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 03"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D42"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 03"
              }
            ],
            "repeated": 0,
            "id": 1854
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "131"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 04"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 04"
              }
            ],
            "repeated": 0,
            "id": 1855
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "131"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 04"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D43"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 04"
              }
            ],
            "repeated": 0,
            "id": 1856
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "132"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 05"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 05"
              }
            ],
            "repeated": 0,
            "id": 1857
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "132"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 05"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 05"
              }
            ],
            "repeated": 0,
            "id": 1858
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "133"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 06"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 06"
              }
            ],
            "repeated": 0,
            "id": 1859
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "133"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 06"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D45"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 06"
              }
            ],
            "repeated": 0,
            "id": 1860
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "134"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 07"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 07"
              }
            ],
            "repeated": 0,
            "id": 1861
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "134"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 07"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D46"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 07"
              }
            ],
            "repeated": 0,
            "id": 1862
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "135"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 08"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 08"
              }
            ],
            "repeated": 0,
            "id": 1863
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "135"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 08"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D47"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 08"
              }
            ],
            "repeated": 0,
            "id": 1864
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "136"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 09"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 09"
              }
            ],
            "repeated": 0,
            "id": 1865
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "136"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 09"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D48"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 09"
              }
            ],
            "repeated": 0,
            "id": 1866
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "137"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 10"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 10"
              }
            ],
            "repeated": 0,
            "id": 1867
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "137"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 10"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D49"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 10"
              }
            ],
            "repeated": 0,
            "id": 1868
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "138"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 11"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 11"
              }
            ],
            "repeated": 0,
            "id": 1869
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "138"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 11"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 11"
              }
            ],
            "repeated": 0,
            "id": 1870
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "139"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 12"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 12"
              }
            ],
            "repeated": 0,
            "id": 1871
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "139"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 12"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 12"
              }
            ],
            "repeated": 0,
            "id": 1872
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "140"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 13"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 13"
              }
            ],
            "repeated": 0,
            "id": 1873
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "140"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 13"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 13"
              }
            ],
            "repeated": 0,
            "id": 1874
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "141"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 14"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 14"
              }
            ],
            "repeated": 0,
            "id": 1875
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "141"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 14"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 14"
              }
            ],
            "repeated": 0,
            "id": 1876
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "142"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 15"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 15"
              }
            ],
            "repeated": 0,
            "id": 1877
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "142"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 15"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 15"
              }
            ],
            "repeated": 0,
            "id": 1878
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "143"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 16"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 16"
              }
            ],
            "repeated": 0,
            "id": 1879
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "143"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 16"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D4F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 16"
              }
            ],
            "repeated": 0,
            "id": 1880
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "144"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 17"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 17"
              }
            ],
            "repeated": 0,
            "id": 1881
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "144"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 17"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D50"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 17"
              }
            ],
            "repeated": 0,
            "id": 1882
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "145"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 18"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 18"
              }
            ],
            "repeated": 0,
            "id": 1883
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "145"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 18"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D51"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 18"
              }
            ],
            "repeated": 0,
            "id": 1884
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "146"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 19"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 19"
              }
            ],
            "repeated": 0,
            "id": 1885
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "146"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 19"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D52"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 19"
              }
            ],
            "repeated": 0,
            "id": 1886
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "147"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 20"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 20"
              }
            ],
            "repeated": 0,
            "id": 1887
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "147"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 20"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D53"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 20"
              }
            ],
            "repeated": 0,
            "id": 1888
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "148"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 21"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 21"
              }
            ],
            "repeated": 0,
            "id": 1889
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "148"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 21"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D54"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 21"
              }
            ],
            "repeated": 0,
            "id": 1890
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "149"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 22"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 22"
              }
            ],
            "repeated": 0,
            "id": 1891
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "149"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 22"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D55"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 22"
              }
            ],
            "repeated": 0,
            "id": 1892
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "150"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 23"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 23"
              }
            ],
            "repeated": 0,
            "id": 1893
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "150"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 23"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D56"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 23"
              }
            ],
            "repeated": 0,
            "id": 1894
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "151"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 24"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 24"
              }
            ],
            "repeated": 0,
            "id": 1895
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "151"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 24"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D57"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 24"
              }
            ],
            "repeated": 0,
            "id": 1896
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "152"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 25"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 25"
              }
            ],
            "repeated": 0,
            "id": 1897
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "152"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 25"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D58"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 25"
              }
            ],
            "repeated": 0,
            "id": 1898
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "153"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 26"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 26"
              }
            ],
            "repeated": 0,
            "id": 1899
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "153"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 26"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D59"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 26"
              }
            ],
            "repeated": 0,
            "id": 1900
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "154"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 27"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 27"
              }
            ],
            "repeated": 0,
            "id": 1901
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "154"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 27"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 27"
              }
            ],
            "repeated": 0,
            "id": 1902
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "155"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 28"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 28"
              }
            ],
            "repeated": 0,
            "id": 1903
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "155"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 28"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 28"
              }
            ],
            "repeated": 0,
            "id": 1904
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "156"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 29"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 29"
              }
            ],
            "repeated": 0,
            "id": 1905
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "156"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 29"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5C"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 29"
              }
            ],
            "repeated": 0,
            "id": 1906
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "157"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 30"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 30"
              }
            ],
            "repeated": 0,
            "id": 1907
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "157"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 30"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5D"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 30"
              }
            ],
            "repeated": 0,
            "id": 1908
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "158"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 31"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 31"
              }
            ],
            "repeated": 0,
            "id": 1909
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "158"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 31"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5E"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 31"
              }
            ],
            "repeated": 0,
            "id": 1910
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "159"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 32"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 32"
              }
            ],
            "repeated": 0,
            "id": 1911
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "159"
              },
              {
                "name": "ValueName",
                "value": "SkyLake LPC and eSPI 32"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D5F"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake LPC and eSPI 32"
              }
            ],
            "repeated": 0,
            "id": 1912
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "160"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 01"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 01"
              }
            ],
            "repeated": 0,
            "id": 1913
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "160"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 01"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D10"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 01"
              }
            ],
            "repeated": 0,
            "id": 1914
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "161"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 02"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 02"
              }
            ],
            "repeated": 0,
            "id": 1915
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "161"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 02"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D11"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 02"
              }
            ],
            "repeated": 0,
            "id": 1916
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "162"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 03"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 03"
              }
            ],
            "repeated": 0,
            "id": 1917
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "162"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 03"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D12"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 03"
              }
            ],
            "repeated": 0,
            "id": 1918
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "163"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 04"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 04"
              }
            ],
            "repeated": 0,
            "id": 1919
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "163"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 04"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D13"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 04"
              }
            ],
            "repeated": 0,
            "id": 1920
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "164"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 05"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 05"
              }
            ],
            "repeated": 0,
            "id": 1921
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "164"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 05"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D14"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 05"
              }
            ],
            "repeated": 0,
            "id": 1922
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "165"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 06"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 06"
              }
            ],
            "repeated": 0,
            "id": 1923
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "165"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 06"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D15"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 06"
              }
            ],
            "repeated": 0,
            "id": 1924
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "166"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 07"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 07"
              }
            ],
            "repeated": 0,
            "id": 1925
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "166"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 07"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D16"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 07"
              }
            ],
            "repeated": 0,
            "id": 1926
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "167"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 08"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 08"
              }
            ],
            "repeated": 0,
            "id": 1927
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "167"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 08"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D17"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 08"
              }
            ],
            "repeated": 0,
            "id": 1928
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "168"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 09"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 09"
              }
            ],
            "repeated": 0,
            "id": 1929
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "168"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 09"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D18"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 09"
              }
            ],
            "repeated": 0,
            "id": 1930
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "169"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 10"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 10"
              }
            ],
            "repeated": 0,
            "id": 1931
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "169"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 10"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D19"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 10"
              }
            ],
            "repeated": 0,
            "id": 1932
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "170"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 11"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 11"
              }
            ],
            "repeated": 0,
            "id": 1933
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "170"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 11"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D1A"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 11"
              }
            ],
            "repeated": 0,
            "id": 1934
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "171"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 12"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "DataLength",
                "value": "44"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 12"
              }
            ],
            "repeated": 0,
            "id": 1935
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegEnumValueW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "Index",
                "value": "171"
              },
              {
                "name": "ValueName",
                "value": "SkyLake Root Port 12"
              },
              {
                "name": "Data",
                "value": "PCI\\VEN_8086&DEV_9D1B"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\DmaSecurity\\Default\\AllowedBuses\\SkyLake Root Port 12"
              }
            ],
            "repeated": 0,
            "id": 1936
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1937
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              },
              {
                "name": "Handle",
                "value": "0x00000438"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses"
              }
            ],
            "repeated": 0,
            "id": 1938
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1939
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1940
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "DEVOBJ.dll"
              }
            ],
            "repeated": 0,
            "id": 1941
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devobj.dll"
              }
            ],
            "repeated": 0,
            "id": 1942
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devobj.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1943
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000438"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\devobj.dll"
              }
            ],
            "repeated": 0,
            "id": 1944
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000454"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96050000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00033000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1945
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96080000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1946
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1947
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1948
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1949
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1950
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1951
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1952
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000438"
              }
            ],
            "repeated": 0,
            "id": 1953
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96072000"
              },
              {
                "name": "ModuleName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1954
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 1955
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\devobj"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96050000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff960575d0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1956
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1957
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1958
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1959
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470803"
              },
              {
                "name": "InBuffer",
                "value": "\\x18\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcc\\x19\\x00\\x00\\x00\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x00E\\x007\\x007\\x00A\\x002\\x002\\x007\\x00D\\x00-\\x004\\x00A\\x00C\\x00D\\x00-\\x004\\x000\\x005\\x008\\x00-\\x00B\\x00A\\x006\\x002\\x00-\\x002\\x004\\x00E\\x00E\\x004\\x000\\x008\\x00B\\x00D\\x001\\x00F\\x00D\\x00}\\x00\\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 1960
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdcD\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1961
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xdd|\\xa2q*\\x81\\xd0\\x11\\xbe\\xc7\\x08\\x00+\\xe2\t/\\x03\\x08\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1962
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1963
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 1964
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 1,
            "id": 1965
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x03\\x08\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1966
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xf0\\x0eW\\x85"
              }
            ],
            "repeated": 0,
            "id": 1967
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 1968
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x92\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1969
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1970
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x13\\x00\\x00\\xd9"
              }
            ],
            "repeated": 0,
            "id": 1971
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x03\\x08\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1972
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xb0\\x10W\\x85"
              }
            ],
            "repeated": 0,
            "id": 1973
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1974
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1975
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x02\\x08"
              }
            ],
            "repeated": 0,
            "id": 1976
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdcD\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1977
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00`\\x9e\\xfc6e\\xc4\\xcf\\x11\\x80VDEST\\x00\\x00\\x13\\x00\\x00\\xa9"
              }
            ],
            "repeated": 0,
            "id": 1978
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1979
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1980
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdc\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1981
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00k\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1982
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdc\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1983
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00o\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x03\\x08\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1984
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x18\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1985
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 1986
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1987
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1988
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00h\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1989
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18P\\x01O\\x85"
              }
            ],
            "repeated": 0,
            "id": 1990
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x1fW\\x85"
              }
            ],
            "repeated": 0,
            "id": 1991
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x92\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1992
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00{\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1993
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1994
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00x\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1995
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00r\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x16\\x00\\x00\""
              }
            ],
            "repeated": 0,
            "id": 1996
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 1997
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00n\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18trin"
              }
            ],
            "repeated": 0,
            "id": 1998
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xdd|\\xa2q*\\x81\\xd0\\x11\\xbe\\xc7\\x08\\x00+\\xe2\t/trin"
              }
            ],
            "repeated": 0,
            "id": 1999
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00`\\x9e\\xfc6e\\xc4\\xcf\\x11\\x80VDEST\\x00\\x00\n\\x00\\x00\\x80"
              }
            ],
            "repeated": 0,
            "id": 2000
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2001
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00A\\xc7\\xf9bZ\\xb2\\xceF\\xb5L\\x9b\\xcc\\xce\\x08\\xb6\\xf2\\x00\\x1fW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2002
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00f\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x03\\x08\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2003
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00g\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xf0\\x0eW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2004
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2005
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00j\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x92\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2006
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2007
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1a\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2008
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18/\\x00\\xc8\\x00"
              }
            ],
            "repeated": 0,
            "id": 2009
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xb0\\x10W\\x85"
              }
            ],
            "repeated": 0,
            "id": 2010
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0be\\x00\\x1fW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2011
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0beD\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2012
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0be\\x00\\x00\\x02\\x08"
              }
            ],
            "repeated": 0,
            "id": 2013
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0beD\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2014
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0be\\x13\\x00\\x00\\xa9"
              }
            ],
            "repeated": 0,
            "id": 2015
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xc3}\\x12P6\\x0f^A\\xa6\\xccL\\xb3\\xbe\\x91\\x0be\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2016
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2017
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2018
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00e\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2019
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xdd|\\xa2q*\\x81\\xd0\\x11\\xbe\\xc7\\x08\\x00+\\xe2\t/\\x00\\x1fW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2020
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00A\\xc7\\xf9bZ\\xb2\\xceF\\xb5L\\x9b\\xcc\\xce\\x08\\xb6\\xf2/\\x00\\xc8\\x00"
              }
            ],
            "repeated": 0,
            "id": 2021
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2022
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18T\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2023
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2024
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x1fW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2025
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00r\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18D\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2026
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xa0\\x17Zt\\xd3t\\xd0\\x11\\xb6\\xfe\\x00\\xa0\\xc9\\x0fW\\xdaD\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2027
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00\\xf9\\xbb\\xd2\\x1e\\xf0\\x11\\x84@\\xb2\\x1f\\xad\\x83\\xa8\\xe6\\xdc\\xdc\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2028
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x1fW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2029
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00o\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\xb0\\x0bW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2030
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\r\\x00\\x00\\x00}\\xe96M%\\xe3\\xce\\x11\\xbf\\xc1\\x08\\x00+\\xe1\\x03\\x18\\x00\\x1fW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2031
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2032
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2033
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2034
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2035
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2036
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x001\\x003\\x003\\x006\\x001\\x009\\x00e\\x004\\x00-\\x001\\x004\\x003\\x00b\\x00-\\x004\\x006\\x003\\x00a\\x00-\\x00b\\x008\\x000\\x009\\x00-\\x00b\\x001\\x00f\\x005\\x001\\x00d\\x000\\x005\\x00f\\x009\\x007\\x003\\x00}\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00{\\x001\\x003\\x003\\x006\\x001\\x009\\x00e\\x004\\x00-\\x001\\x004\\x003\\x00b\\x00-\\x004\\x006\\x003\\x00a\\x00-\\x00b\\x008\\x000\\x009\\x00-\\x00b\\x001\\x00f\\x005\\x001\\x00d\\x000\\x005\\x00f\\x009\\x007\\x003\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd00"
              }
            ],
            "repeated": 0,
            "id": 2037
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2038
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\n"
              }
            ],
            "repeated": 0,
            "id": 2039
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2040
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2041
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2042
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2043
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2044
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00\\x1bu\\xd37"
              }
            ],
            "repeated": 0,
            "id": 2045
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2046
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2047
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2048
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2049
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2050
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2051
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2052
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2053
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2054
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2055
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2056
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernelbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 2057
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetThreadUILanguage"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964ec570"
              }
            ],
            "repeated": 0,
            "id": 2058
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2059
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlCultureNameToLCID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c8b850"
              }
            ],
            "repeated": 0,
            "id": 2060
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetThreadPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c85ca0"
              }
            ],
            "repeated": 0,
            "id": 2061
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2062
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2063
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2064
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetFileMUIPath"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c968f0"
              }
            ],
            "repeated": 0,
            "id": 2065
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2066
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2067
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2068
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2069
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2070
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2071
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2072
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2073
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2074
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2075
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2076
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2077
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2078
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2079
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2080
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2081
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2082
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xd8W\\x8d\\xec"
              }
            ],
            "repeated": 0,
            "id": 2083
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2084
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2085
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2086
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2087
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2088
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2089
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2090
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2091
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2092
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2093
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2094
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2095
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2096
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2097
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2098
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2099
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2100
          },
          {
            "timestamp": "2026-05-28 22:32:01,305",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2101
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2102
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2103
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2104
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2105
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2106
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2107
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2108
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2109
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2110
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2111
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2112
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2113
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2114
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2115
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2116
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2117
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2118
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2119
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2120
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2121
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2122
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2123
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2124
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2125
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2126
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2127
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2128
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2129
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2130
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2131
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2132
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2133
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2134
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2135
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2136
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2137
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2138
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2139
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2140
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2141
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2142
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2143
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2144
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2145
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2146
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2147
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2148
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2149
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2150
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2151
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2152
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2153
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2154
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2155
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2156
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2157
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2158
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2159
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2160
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2161
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2162
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2163
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2164
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2165
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2166
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2167
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2168
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000430"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2169
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2170
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2171
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2172
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2173
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2174
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2175
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2176
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2177
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2178
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2179
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b6855674c0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2180
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2181
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2182
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2183
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2184
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2185
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2186
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2187
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2188
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2189
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2190
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 2,
            "id": 2191
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 2192
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 2193
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2194
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2195
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2196
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2197
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2198
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2199
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2200
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2201
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2202
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2203
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2204
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2205
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2206
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2207
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685566680",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2208
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2209
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2210
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2211
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2212
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2213
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2214
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2215
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2216
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2217
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2218
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 2,
            "id": 2219
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2220
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2221
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2222
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2223
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2224
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2225
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2226
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2227
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2228
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2229
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2230
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2231
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2232
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2233
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2234
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2235
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2236
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2237
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2238
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 2,
            "id": 2239
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2240
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2241
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2242
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2243
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2244
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2245
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2246
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2247
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2248
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2249
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2250
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2251
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2252
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2253
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2254
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2255
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2256
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2257
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2258
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2259
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2260
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2261
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2262
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2263
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2264
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2265
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2266
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 2,
            "id": 2267
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2268
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2269
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2270
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2271
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2272
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2273
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2274
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x18\\xb5X\\x85"
              }
            ],
            "repeated": 0,
            "id": 2275
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2276
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2277
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2278
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2279
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2280
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2281
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2282
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2283
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2284
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2285
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2286
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 2,
            "id": 2287
          },
          {
            "timestamp": "2026-05-28 22:32:01,321",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2288
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2289
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2290
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2291
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2292
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2293
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2294
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2295
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2296
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2297
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2298
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2299
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2300
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2301
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2302
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2303
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2304
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2305
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2306
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2307
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2308
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2309
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2310
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2311
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2312
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2313
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2314
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 2,
            "id": 2315
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2316
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2317
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2318
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2319
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2320
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2321
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2322
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2323
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2324
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2325
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2326
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2327
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2328
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2329
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2330
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2331
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2332
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2333
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2334
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 2,
            "id": 2335
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 2336
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2337
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2338
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2339
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2340
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2341
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2342
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2343
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2344
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2345
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2346
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2347
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2348
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2349
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2350
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2351
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2352
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2353
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2354
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2355
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2356
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2357
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2358
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2359
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2360
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2361
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2362
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2363
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2364
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2365
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2366
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2367
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2368
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2369
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2370
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2371
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2372
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2373
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2374
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2375
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2376
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2377
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2378
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2379
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2380
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2381
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2382
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2383
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2384
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2385
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2386
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2387
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2388
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2389
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2390
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2391
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2392
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2393
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2394
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2395
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2396
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2397
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2398
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2399
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2400
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2401
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2402
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2403
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2404
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2405
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2406
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2407
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2408
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2409
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2410
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2411
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2412
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2413
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2414
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2415
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2416
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2417
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2418
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2419
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2420
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2421
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2422
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2423
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2424
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2425
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2426
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2427
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2428
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2429
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2430
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2431
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2432
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2433
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2434
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2435
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2436
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2437
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2438
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2439
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2440
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2441
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2442
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2443
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2444
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2445
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2446
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2447
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2448
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2449
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2450
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2451
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2452
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2453
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2454
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2455
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2456
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2457
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2458
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2459
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2460
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2461
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2462
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2463
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2464
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2465
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2466
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xd8OW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2467
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2468
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2469
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2470
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2471
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b6855666e0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2472
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2473
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2474
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2475
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2476
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2477
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2478
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2479
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2480
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2481
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2482
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2483
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2484
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2485
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2486
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2487
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2488
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2489
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2490
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2491
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2492
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2493
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2494
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2495
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2496
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2497
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2498
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2499
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2500
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2501
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2502
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2503
          },
          {
            "timestamp": "2026-05-28 22:32:01,336",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2504
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2505
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2506
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2507
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2508
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2509
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2510
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2511
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2512
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2513
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2514
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2515
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2516
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2517
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2518
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2519
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2520
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2521
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2522
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2523
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2524
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2525
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2526
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2527
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2528
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2529
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2530
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2531
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2532
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2533
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2534
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2535
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2536
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2537
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2538
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2539
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2540
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2541
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2542
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2543
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2544
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2545
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2546
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2547
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2548
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2549
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2550
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2551
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2552
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2553
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2554
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2555
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2556
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2557
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2558
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2559
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2560
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2561
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2562
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2563
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2564
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2565
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2566
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2567
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2568
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2569
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2570
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2571
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2572
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2573
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2574
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 2575
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 2576
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 2577
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2578
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 2579
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2580
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2581
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2582
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2583
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2584
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2585
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2586
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2587
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2588
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2589
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2590
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2591
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685566680",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2592
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2593
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2594
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2595
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2596
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2597
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2598
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2599
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2600
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2601
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2602
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2603
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2604
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2605
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2606
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2607
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2608
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2609
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2610
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2611
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2612
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2613
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2614
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2615
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2616
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2617
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2618
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2619
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2620
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2621
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2622
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2623
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2624
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2625
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2626
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2627
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2628
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2629
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2630
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2631
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2632
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2633
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2634
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2635
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2636
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2637
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2638
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xae\\x97k\\xff"
              }
            ],
            "repeated": 0,
            "id": 2639
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2640
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2641
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2642
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2643
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2644
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2645
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2646
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2647
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2648
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2649
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2650
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2651
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2652
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2653
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2654
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2655
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2656
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2657
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2658
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xd8OW\\x85"
              }
            ],
            "repeated": 0,
            "id": 2659
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2660
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2661
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2662
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2663
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2664
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2665
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2666
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2667
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2668
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2669
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2670
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2671
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2672
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2673
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2674
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2675
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2676
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2677
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2678
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2679
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2680
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2681
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2682
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2683
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00C\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x004\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2684
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2685
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2686
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2687
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2688
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2689
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2690
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2691
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2692
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2693
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2694
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2695
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2696
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2697
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2698
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2699
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2700
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2701
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2702
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2703
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2704
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2705
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0h\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2706
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00p\\x00c\\x00i\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00p\\x00c\\x00i\\x00\\\\x00c\\x00c\\x00_\\x000\\x006\\x000\\x004\\x00.\\x00d\\x00e\\x00v\\x00i\\x00c\\x00e\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00P\\x00C\\x00I\\x00-\\x00t\\x00o\\x00-\\x00P\\x00C\\x00I\\x00 \\x00B\\x00r\\x00i\\x00d\\x00g\\x00e\\x00\\x00\\x00\\xf7\\xf8\\xf9\\xff"
              }
            ],
            "repeated": 0,
            "id": 2707
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x49670601"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 2708
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2709
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2710
          },
          {
            "timestamp": "2026-05-28 22:32:01,352",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 2711
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685566680",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaae1534e"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 2712
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2713
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2714
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x00\\x00\\x00\\x00\\x00\\x00<R\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2715
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\pci.PNF"
              }
            ],
            "repeated": 0,
            "id": 2716
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2717
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2718
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 2,
            "id": 2719
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 2720
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 2721
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2722
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 2723
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2724
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2725
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2726
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2727
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2728
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2729
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x006\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00\\x00\\x00i\\x00l\\x00"
              }
            ],
            "repeated": 0,
            "id": 2730
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2731
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc06\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2732
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2733
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2734
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2735
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2736
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2737
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2738
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2739
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xac\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2740
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2741
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x04\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2742
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2743
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x00\\x00\\x00\\x12 \\x00\\x00U\\x00S\\x00B\\x00\\\\x00R\\x00O\\x00O\\x00T\\x00_\\x00H\\x00U\\x00B\\x003\\x000\\x00&\\x00V\\x00I\\x00D\\x001\\x00B\\x003\\x006\\x00&\\x00P\\x00I\\x00D\\x000\\x000\\x000\\x00D\\x00&\\x00R\\x00E\\x00V\\x000\\x000\\x000\\x001\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00R\\x00O\\x00O\\x00T\\x00_\\x00H\\x00U\\x00B\\x003\\x000\\x00&\\x00V\\x00I\\x00D\\x001\\x00B\\x003\\x006\\x00&\\x00P\\x00I\\x00D\\x000\\x000\\x000\\x00D\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00R\\x00O\\x00O\\x00T\\x00_\\x00H\\x00U\\x00B\\x003\\x000\\x00\\x00\\x00\\x00\\x00N\\x00_\\x00"
              }
            ],
            "repeated": 0,
            "id": 2744
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2745
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00<\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2746
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2747
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2748
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2749
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2750
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2751
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00B\\x000\\x000\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00B\\x000\\x000\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00B\\x000\\x000\\x00\\x00\\x00\\x00\\x00gStr"
              }
            ],
            "repeated": 0,
            "id": 2752
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2753
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2754
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2755
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0R\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2756
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2757
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00V\\x00O\\x00L\\x00M\\x00G\\x00R\\x00\\x00\\x00\\x00\\x003\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 2758
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2759
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x00\\x00\\x00\\x12 \\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00\\\\x00v\\x00o\\x00l\\x00m\\x00g\\x00r\\x00\\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00\\\\x00v\\x00o\\x00l\\x00m\\x00g\\x00r\\x00\\x00\\x00\\x00\\x00g\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 2760
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2761
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2762
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2763
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2764
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2765
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x000\\x00f\\x004\\x001\\x003\\x000\\x00d\\x00d\\x00-\\x001\\x009\\x00c\\x007\\x00-\\x007\\x00a\\x00b\\x006\\x00-\\x009\\x009\\x00a\\x001\\x00-\\x009\\x008\\x000\\x00f\\x000\\x003\\x00b\\x002\\x00e\\x00e\\x004\\x00e\\x00}\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00{\\x000\\x00f\\x004\\x001\\x003\\x000\\x00d\\x00d\\x00-\\x001\\x009\\x00c\\x007\\x00-\\x007\\x00a\\x00b\\x006\\x00-\\x009\\x009\\x00a\\x001\\x00-\\x009\\x008\\x000\\x00f\\x000\\x003\\x00b\\x002\\x00e\\x00e\\x004\\x00e\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2766
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2767
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2768
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2769
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2770
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2771
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2772
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2773
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x003\\x000\\x003\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x003\\x000\\x003\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x003\\x000\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00"
              }
            ],
            "repeated": 0,
            "id": 2774
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2775
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xae\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2776
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2777
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2778
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2779
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00_\\x00s\\x007\\x00d\\x001\\x004\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00_\\x00s\\x007\\x00d\\x001\\x004\\x00\\x00\\x00\\x00\\x00_\\x008\\x00"
              }
            ],
            "repeated": 0,
            "id": 2780
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2781
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x001\\x001\\x00"
              }
            ],
            "repeated": 0,
            "id": 2782
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2783
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2784
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2785
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x04\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2786
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2787
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x01\\x00\\x00\\x12 \\x00\\x00H\\x00I\\x00D\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x000\\x00\\x00\\x00H\\x00I\\x00D\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00\\x00\\x00H\\x00I\\x00D\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00U\\x00P\\x00:\\x000\\x000\\x000\\x001\\x00_\\x00U\\x00:\\x000\\x000\\x000\\x002\\x00\\x00\\x00H\\x00I\\x00D\\x00_\\x00D\\x00E\\x00V\\x00I\\x00C\\x00E\\x00_\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x00_\\x00M\\x00O\\x00U\\x00S\\x00E\\x00\\x00\\x00H\\x00I\\x00D\\x00_\\x00D\\x00E\\x00V\\x00I\\x00C\\x00E\\x00_\\x00U\\x00P\\x00:\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2788
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2789
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00P\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00\\xb6\\x02"
              }
            ],
            "repeated": 0,
            "id": 2790
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2791
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0&\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2792
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2793
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2794
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2795
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00B\\x00a\\x00s\\x00i\\x00c\\x00D\\x00i\\x00s\\x00p\\x00l\\x00a\\x00y\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2796
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2797
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2798
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2799
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2800
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2801
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00C\\x000\\x001\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x001\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00O\\x00"
              }
            ],
            "repeated": 0,
            "id": 2802
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2803
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0`\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2804
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2805
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2806
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2807
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x006\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00Q\\x00E\\x00M\\x00U\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x002\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00Q\\x00E\\x00M\\x00U\\x000\\x000\\x000\\x002\\x00\\x00\\x00*\\x00Q\\x00E\\x00M\\x00U\\x000\\x000\\x000\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2808
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2809
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2810
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2811
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2812
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2813
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1c\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00V\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2814
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2815
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2816
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2817
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2818
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2819
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2820
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2821
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x001\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x003\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2822
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2823
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0&\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2824
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2825
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2826
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2827
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00.\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00C\\x00o\\x00m\\x00p\\x00o\\x00s\\x00i\\x00t\\x00e\\x00B\\x00u\\x00s\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2828
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2829
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2830
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2831
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2832
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2833
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00v\\x00d\\x00r\\x00v\\x00r\\x00o\\x00o\\x00t\\x00\\x00\\x00\\x00\\x00P\\x00N\\x00"
              }
            ],
            "repeated": 0,
            "id": 2834
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2835
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2836
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2837
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2838
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2839
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x008\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x006\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00"
              }
            ],
            "repeated": 0,
            "id": 2840
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2841
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2842
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2843
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0^\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2844
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2845
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00R\\x00o\\x00o\\x00t\\x00\\\\x00S\\x00p\\x00a\\x00c\\x00e\\x00p\\x00o\\x00r\\x00t\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 2846
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2847
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00(\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00^\\x00\\x00\\x00\\x12 \\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00\\\\x00s\\x00p\\x00a\\x00c\\x00e\\x00p\\x00o\\x00r\\x00t\\x00\\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00\\\\x00s\\x00p\\x00a\\x00c\\x00e\\x00p\\x00o\\x00r\\x00t\\x00\\x00\\x00\\x00\\x00s\\x00=\\x00"
              }
            ],
            "repeated": 0,
            "id": 2848
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2849
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2850
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2851
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2852
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2853
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00F\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x006\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00in"
              }
            ],
            "repeated": 0,
            "id": 2854
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2855
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2856
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2857
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2858
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2859
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x005\\x000\\x001\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x005\\x000\\x001\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x005\\x000\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\x00"
              }
            ],
            "repeated": 0,
            "id": 2860
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2861
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x18\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2862
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2863
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2864
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2865
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x12 \\x00\\x00r\\x00o\\x00o\\x00t\\x00\\\\x00k\\x00d\\x00n\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00c\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 2866
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2867
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0`\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2868
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2869
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2870
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2871
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00A\\x00C\\x00P\\x00I\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x001\\x000\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00A\\x00C\\x00P\\x00I\\x000\\x000\\x001\\x000\\x00\\x00\\x00*\\x00A\\x00C\\x00P\\x00I\\x000\\x000\\x001\\x000\\x00\\x00\\x00\\x00\\x00S\\x00E\\x00"
              }
            ],
            "repeated": 0,
            "id": 2872
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2873
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x005\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00"
              }
            ],
            "repeated": 0,
            "id": 2874
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2875
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc02\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2876
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2877
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2878
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2879
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x002\\x00\\x00\\x00\\x12 \\x00\\x00M\\x00O\\x00N\\x00I\\x00T\\x00O\\x00R\\x00\\\\x00D\\x00e\\x00f\\x00a\\x00u\\x00l\\x00t\\x00_\\x00M\\x00o\\x00n\\x00i\\x00t\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2880
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2881
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00R\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x009\\x00F\\x00F\\x00\\x00\\x00\\x00\\x00\\x00\\x0026"
              }
            ],
            "repeated": 0,
            "id": 2882
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2883
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2884
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2885
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2886
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2887
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 2888
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2889
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2890
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2891
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2892
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2893
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x003\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2894
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2895
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x00D\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x003\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00B\\x003\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x003\\x003\\x00"
              }
            ],
            "repeated": 0,
            "id": 2896
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2897
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x18\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2898
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2899
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2900
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2901
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00 \\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x12 \\x00\\x00r\\x00o\\x00o\\x00t\\x00\\\\x00u\\x00m\\x00b\\x00u\\x00s\\x00\\x00\\x00\\x00\\x00c\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 2902
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2903
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2904
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2905
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2906
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2907
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00b\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2908
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2909
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2910
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2911
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2912
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2913
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00a\\x00c\\x00p\\x00i\\x00a\\x00p\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00C\\x00"
              }
            ],
            "repeated": 0,
            "id": 2914
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2915
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00\\\\x00A\\x00C\\x00P\\x00I\\x00_\\x00H\\x00A\\x00L\\x00\\x00\\x00D\\x00E\\x00T\\x00E\\x00C\\x00T\\x00E\\x00D\\x00\\\\x00A\\x00C\\x00P\\x00I\\x00_\\x00H\\x00A\\x00L\\x00\\x00\\x00\\x00\\x00\\x00\\x00Ea"
              }
            ],
            "repeated": 0,
            "id": 2916
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2917
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2918
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2919
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0(\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2920
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2921
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x01\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00M\\x00Z\\x007\\x006\\x00E\\x001\\x002\\x000\\x002\\x00.\\x005\\x00+\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00M\\x00Z\\x007\\x006\\x00E\\x001\\x002\\x000\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00S\\x00A\\x00M\\x00S\\x00U\\x00N\\x00G\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00_\\x00M\\x00Z\\x007\\x006\\x00E\\x001\\x002\\x000\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 2922
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2923
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00p\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00D\\x00i\\x00s\\x00k\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00R\\x00A\\x00W\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2924
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2925
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2926
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2927
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x14\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2928
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2929
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00A\\x000\\x008\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x008\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x008\\x00\\x00\\x00\\x00\\x002\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2930
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2931
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x12 \\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00A\\x000\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00"
              }
            ],
            "repeated": 0,
            "id": 2932
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2933
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2934
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2935
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2936
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2937
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 2938
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2939
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x002\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x001\\x000\\x006\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 2940
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2941
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc06\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2942
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2943
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2944
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2945
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00_\\x00H\\x00A\\x00L\\x00\\\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x008\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00C\\x000\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2946
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2947
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1a\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2948
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2949
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x1a\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2950
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2951
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2952
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2953
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2954
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2955
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00,\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00B\\x00a\\x00s\\x00i\\x00c\\x00R\\x00e\\x00n\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00ol"
              }
            ],
            "repeated": 0,
            "id": 2956
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2957
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0>\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2958
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2959
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2960
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2961
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00:\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00>\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00F\\x00i\\x00x\\x00e\\x00d\\x00B\\x00u\\x00t\\x00t\\x00o\\x00n\\x00\\x00\\x00*\\x00F\\x00i\\x00x\\x00e\\x00d\\x00B\\x00u\\x00t\\x00t\\x00o\\x00n\\x00\\x00\\x00\\x00\\x00\\x00\\x00S\\x00"
              }
            ],
            "repeated": 0,
            "id": 2962
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2963
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2964
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2965
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2966
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2967
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 2968
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2969
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 2970
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2971
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2972
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2973
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2974
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2975
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 2976
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2977
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00n\\x00f\\x00"
              }
            ],
            "repeated": 0,
            "id": 2978
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2979
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2980
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2981
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2982
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2983
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 2984
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2985
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00n\\x00f\\x00"
              }
            ],
            "repeated": 0,
            "id": 2986
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2987
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2988
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2989
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2990
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2991
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 2992
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2993
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 2994
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 2995
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2996
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2997
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2998
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 2999
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3000
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3001
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 3002
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3003
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3004
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3005
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3006
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3007
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa6\\x01\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00*\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00l\\x00y\\x00_\\x006\\x00_\\x00M\\x00o\\x00d\\x00e\\x00l\\x00_\\x009\\x004\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00G\\x00e\\x00n\\x00u\\x00i\\x00n\\x00e\\x00I\\x00n\\x00t\\x00e\\x00l\\x00_\\x00-\\x00_\\x00I\\x00n\\x00t\\x00e\\x00l\\x006\\x004\\x00_\\x00F\\x00a\\x00m\\x00i\\x00"
              }
            ],
            "repeated": 0,
            "id": 3008
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3009
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00r\\x00o\\x00c\\x00e\\x00s\\x00s\\x00o\\x00r\\x00\\x00\\x00\\x00\\x00N\\x00F\\x00"
              }
            ],
            "repeated": 0,
            "id": 3010
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3011
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3012
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3013
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3014
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3015
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3016
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3017
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x00C\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3018
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3019
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3020
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3021
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3022
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3023
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3024
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3025
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x003\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x00C\\x000\\x005\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3026
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3027
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0@\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3028
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3029
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0*\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3030
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3031
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x01\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00_\\x00_\\x00_\\x00_\\x002\\x00.\\x005\\x00+\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00_\\x00_\\x00_\\x00_\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00_\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00_\\x00_\\x00"
              }
            ],
            "repeated": 0,
            "id": 3032
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3033
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00x\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00C\\x00d\\x00R\\x00o\\x00m\\x00\\x00\\x00S\\x00C\\x00S\\x00I\\x00\\\\x00R\\x00A\\x00W\\x00\\x00\\x00\\x00\\x00o\\x00r\\x00"
              }
            ],
            "repeated": 0,
            "id": 3034
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3035
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0 \\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3036
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3037
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3038
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3039
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x8e\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x12 \\x00\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00n\\x00f\\x00"
              }
            ],
            "repeated": 0,
            "id": 3040
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3041
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3042
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3043
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc08\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3044
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3045
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00N\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x12 \\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3046
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3047
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3048
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3049
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3050
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3051
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3052
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3053
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00~\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x004\\x005\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00&\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x000\\x00F\\x00F\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3054
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3055
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0*\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3056
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3057
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3058
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3059
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x002\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00N\\x00d\\x00i\\x00s\\x00V\\x00i\\x00r\\x00t\\x00u\\x00a\\x00l\\x00B\\x00u\\x00s\\x00\\x00\\x00\\x00\\x00o\\x00r\\x00"
              }
            ],
            "repeated": 0,
            "id": 3060
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3061
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3062
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3063
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3064
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3065
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x001\\x001\\x000\\x000\\x001\\x00A\\x00F\\x004\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3066
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3067
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x002\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x002\\x009\\x001\\x008\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x006\\x000\\x001\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3068
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3069
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0b\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3070
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00m\\x00a\\x00c\\x00h\\x00i\\x00n\\x00e\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00l\\x00p\\x00c\\x00c\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00_\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00L\\x00P\\x00C\\x00 \\x00C\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3071
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b6855674c0",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x495fe23f"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 3072
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3073
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 3074
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 3075
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685566680",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaaded80c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 3076
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3077
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3078
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x02\\x00\\x00\\x00\\x00\\x00|Y\\x02\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3079
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              }
            ],
            "repeated": 0,
            "id": 3080
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00026000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3081
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3082
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 3083
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 3084
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 3085
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00026000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3086
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3087
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3088
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3089
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0b\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3090
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00\\x00\\x000\\xf1%\\xb7\\xefG\\x1a\\x10\\xa5\\xf1\\x02`\\x8c\\x9e\\xeb\\xac\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00\\x19\\x00\\x00\\x00@\\x00m\\x00a\\x00c\\x00h\\x00i\\x00n\\x00e\\x00.\\x00i\\x00n\\x00f\\x00,\\x00%\\x00l\\x00p\\x00c\\x00c\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00_\\x00d\\x00e\\x00s\\x00c\\x00%\\x00;\\x00L\\x00P\\x00C\\x00 \\x00C\\x00o\\x00n\\x00t\\x00r\\x00o\\x00l\\x00l\\x00e\\x00r\\x00\\x00\\x00i\\x00c\\x00"
              }
            ],
            "repeated": 0,
            "id": 3091
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.inf"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0x495fe23f"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01da265c"
              }
            ],
            "repeated": 0,
            "id": 3092
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3093
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 3094
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              }
            ],
            "repeated": 0,
            "id": 3095
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x2b685567460",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xaaded80c"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5ace3"
              }
            ],
            "repeated": 0,
            "id": 3096
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3097
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3098
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x02\\x00\\x00\\x00\\x00\\x00|Y\\x02\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3099
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\INF\\machine.PNF"
              }
            ],
            "repeated": 0,
            "id": 3100
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "SectionOffset",
                "value": "0xddd5bfd160"
              },
              {
                "name": "ViewSize",
                "value": "0x00026000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3101
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3102
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 2,
            "id": 3103
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 3104
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 3105
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00026000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3106
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3107
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3108
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3109
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3110
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3111
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3112
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3113
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00&\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00m\\x00s\\x00s\\x00m\\x00b\\x00i\\x00o\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00n\\x00"
              }
            ],
            "repeated": 0,
            "id": 3114
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3115
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0$\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3116
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3117
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3118
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3119
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x008\\x000\\x008\\x006\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00S\\x00U\\x00B\\x00S\\x00Y\\x00S\\x00_\\x000\\x000\\x000\\x000\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00"
              }
            ],
            "repeated": 0,
            "id": 3120
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3121
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00|\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x01\\x00\\x00\\x12 \\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00D\\x00E\\x00V\\x00_\\x001\\x000\\x00D\\x003\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00&\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x008\\x000\\x008\\x006\\x00\\x00\\x00P\\x00C\\x00I\\x00\\\\x00C\\x00C\\x00_\\x000\\x002\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3122
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3123
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0l\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3124
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3125
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x90\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3126
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3127
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00\\x00\\x00\\x12 \\x00\\x00U\\x00S\\x00B\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00&\\x00R\\x00E\\x00V\\x00_\\x000\\x000\\x000\\x000\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00V\\x00I\\x00D\\x00_\\x000\\x006\\x002\\x007\\x00&\\x00P\\x00I\\x00D\\x00_\\x000\\x000\\x000\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3128
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3129
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00`\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x00\\x00\\x00\\x12 \\x00\\x00U\\x00S\\x00B\\x00\\\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x003\\x00&\\x00S\\x00u\\x00b\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x000\\x00&\\x00P\\x00r\\x00o\\x00t\\x00_\\x000\\x000\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x003\\x00&\\x00S\\x00u\\x00b\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x000\\x00\\x00\\x00U\\x00S\\x00B\\x00\\\\x00C\\x00l\\x00a\\x00s\\x00s\\x00_\\x000\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3130
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3131
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3132
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3133
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0T\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3134
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3135
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe6\\x00\\x00\\x00\\x12 \\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00{\\x000\\x008\\x004\\x00f\\x000\\x001\\x00f\\x00a\\x00-\\x00e\\x006\\x003\\x004\\x00-\\x004\\x00d\\x007\\x007\\x00-\\x008\\x003\\x00e\\x00e\\x00-\\x000\\x007\\x004\\x008\\x001\\x007\\x00c\\x000\\x003\\x005\\x008\\x001\\x00}\\x00\\x00\\x00P\\x00R\\x00I\\x00N\\x00T\\x00E\\x00N\\x00U\\x00M\\x00\\\\x00L\\x00o\\x00c\\x00a\\x00l\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00{\\x000\\x008\\x004\\x00f\\x000\\x001\\x00f\\x00a\\x00-\\x00e\\x006\\x003\\x004\\x00-\\x004\\x00d\\x007\\x007\\x00-\\x008\\x003\\x00e\\x00e\\x00-\\x000\\x007\\x004\\x008\\x001\\x007\\x00c\\x000\\x003\\x005\\x008\\x001\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3136
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3137
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00j\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00T\\x00\\x00\\x00\\x12 \\x00\\x00G\\x00e\\x00n\\x00P\\x00r\\x00i\\x00n\\x00t\\x00Q\\x00u\\x00e\\x00u\\x00e\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00R\\x00a\\x00w\\x00\\x00\\x00S\\x00W\\x00D\\x00\\\\x00G\\x00e\\x00n\\x00e\\x00r\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3138
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3139
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3140
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3141
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3142
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3143
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00S\\x00W\\x00E\\x00N\\x00U\\x00M\\x00\\x00\\x00\\x00\\x00i\\x00.\\x00"
              }
            ],
            "repeated": 0,
            "id": 3144
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3145
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0Z\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3146
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3147
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3148
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3149
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x004\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00\\x12 \\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00V\\x00E\\x00N\\x00_\\x00P\\x00N\\x00P\\x00&\\x00D\\x00E\\x00V\\x00_\\x000\\x00F\\x001\\x003\\x00\\x00\\x00A\\x00C\\x00P\\x00I\\x00\\\\x00P\\x00N\\x00P\\x000\\x00F\\x001\\x003\\x00\\x00\\x00*\\x00P\\x00N\\x00P\\x000\\x00F\\x001\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03"
              }
            ],
            "repeated": 0,
            "id": 3150
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3151
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3152
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3153
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00%\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3154
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3155
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000022c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470813"
              },
              {
                "name": "InBuffer",
                "value": "H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\"\\x00\\x00\\x00N%\\\\xa4\\x1c\\xdf\\xfdN\\x80 g\\xd1F\\xa8P\\xe0\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x12 \\x00\\x00R\\x00O\\x00O\\x00T\\x00\\\\x00R\\x00D\\x00P\\x00B\\x00U\\x00S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3156
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 1,
            "id": 3157
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x000f003f",
                "pretty_value": "KEY_ALL_ACCESS"
              },
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus"
              },
              {
                "name": "Disposition",
                "value": "1",
                "pretty_value": "REG_CREATED_NEW_KEY"
              }
            ],
            "repeated": 0,
            "id": 3158
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "HstiDmaLogged"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged"
              }
            ],
            "repeated": 0,
            "id": 3159
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "HstiDmaLogged"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "1"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged"
              }
            ],
            "repeated": 0,
            "id": 3160
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3161
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              }
            ],
            "repeated": 0,
            "id": 3162
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3163
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855c5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3164
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3165
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855c5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3166
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software"
              },
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software"
              }
            ],
            "repeated": 0,
            "id": 3167
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System"
              },
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System"
              }
            ],
            "repeated": 0,
            "id": 3168
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 3169
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 3170
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 3171
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000042c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3172
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000042c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\tbs.dll"
              }
            ],
            "repeated": 0,
            "id": 3173
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000043c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3174
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3175
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3176
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3177
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3178
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3179
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "imagehlp.dll"
              }
            ],
            "repeated": 0,
            "id": 3180
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000440"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0001d000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3181
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98577000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3182
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3183
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3184
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3185
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3186
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3187
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 3188
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3189
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3190
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9856c000"
              },
              {
                "name": "ModuleName",
                "value": "imagehlp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3191
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e471000"
              },
              {
                "name": "ModuleName",
                "value": "tbs.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3192
          },
          {
            "timestamp": "2026-05-28 22:32:01,368",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 3193
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 3194
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\imagehlp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff985623b0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3195
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\tbs"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8e465fa0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3196
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3197
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d94c000"
              },
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3198
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0000000",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE"
              },
              {
                "name": "FileName",
                "value": "\\??\\TPM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 1,
            "id": 3199
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": false,
            "return": "0xffffffffc0000008",
            "pretty_return": "INVALID_HANDLE",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3200
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 3201
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 3202
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3203
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4652",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              }
            ],
            "repeated": 0,
            "id": 3204
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae3da6",
            "parentcaller": "0x7ff726ae46e0",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#60"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 3,
            "id": 3205
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae3db9",
            "parentcaller": "0x7ff726ae474b",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c60",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#61"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3206
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae47e7",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "NgscbCheckPreventDeviceEncryption"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8d9070"
              }
            ],
            "repeated": 0,
            "id": 3207
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40a1",
            "parentcaller": "0x7ff726ae480d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "NgscbCheckPreventDeviceEncryptionForAad"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8d9130"
              }
            ],
            "repeated": 0,
            "id": 3208
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3209
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3210
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000428"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              }
            ],
            "repeated": 0,
            "id": 3211
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "PreventDeviceEncryption"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryption"
              }
            ],
            "repeated": 0,
            "id": 3212
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40be",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              }
            ],
            "repeated": 0,
            "id": 3213
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3214
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000e0"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3215
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000428"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000e0"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker"
              }
            ],
            "repeated": 0,
            "id": 3216
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "PreventDeviceEncryptionForAzureADJoinedDevices"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryptionForAzureADJoinedDevices"
              }
            ],
            "repeated": 0,
            "id": 3217
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae40e1",
            "parentcaller": "0x7ff726ae480d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              }
            ],
            "repeated": 0,
            "id": 3218
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4826",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "NgscbGetWinReConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8da9e0"
              }
            ],
            "repeated": 0,
            "id": 3219
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\reinfo"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 3220
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "reinfo.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 3221
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7fb70000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "reinfo.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 3222
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "reinfo.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7fb70000"
              },
              {
                "name": "FunctionName",
                "value": "WinReGetConfig"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7fb71010"
              }
            ],
            "repeated": 0,
            "id": 3223
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 1,
            "id": 3224
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3225
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3226
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00]\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3227
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "HandleName",
                "value": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
              },
              {
                "name": "Buffer",
                "value": "\\xfeff<?xml version='1.0' encoding='utf-8'?>\n\r\n<WindowsRE version=\"2.0\">\r\n  <WinreBCD id=\"{268468c0-5aec-11f1-ab56-c28492c2c606}\"/>\r\n  <WinreLocation path=\"\\Recovery\\WindowsRE\" id=\"1384910895\" offset=\"63849889792\" guid=\"{00000000-0000-0000-0000-000000000000}\""
              },
              {
                "name": "Length",
                "value": "1117"
              }
            ],
            "repeated": 0,
            "id": 3228
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3229
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a712000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3230
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3231
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855db000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3232
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855db000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3233
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a715000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3234
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3235
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3236
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xe6\\x03\\x00\\x00\\x06\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3237
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xe6\\x03\\x00\\x00\\x06\\x00\\x00\\x00\\xd2\\x00\\x00\\x00`\\x00\\x00\\x00\\x98\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\xa4\\x00\\x00\\x00.\\x00\\x00\\x00l\\x01\\x00\\x00\\x1c\\x00\\x00\\x002\\x01\\x00\\x00\\x0c\\x00\\x00\\x00>\\x01\\x00\\x00.\\x00\\x00\\x00\\x88\\x01\\x00\\x00`\\x00\\x00\\x002\\x01\\x00\\x00\\x0c\\x00\\x00\\x00>\\x01\\x00\\x00.\\x00\\x00\\x00\"\\x02\\x00\\x00`\\x00\\x00\\x00\\xe8\\x01\\x00\\x00\\x0c\\x00\\x00\\x00\\xf4\\x01\\x00\\x00.\\x00\\x00\\x00j\\x03\\x00\\x00\\x1c\\x00\\x00\\x00\\x82\\x02\\x00\\x00\\xcc\\x00\\x00\\x00N\\x03\\x00\\x00\\x1c\\x00\\x00\\x00\\x86\\x03\\x00\\x00`\\x00\\x00\\x00\\x82\\x02\\x00\\x00\\xcc\\x00\\x00\\x00N\\x03\\x00\\x00\\x1c\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x001\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x00"
              }
            ],
            "repeated": 0,
            "id": 3238
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3239
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-100000000000}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3240
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 3241
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3242
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-100000000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3243
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1400",
                "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY"
              },
              {
                "name": "InBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xd6\\xbf\\xd5"
              },
              {
                "name": "OutBuffer",
                "value": " \\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00!\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x0b\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3244
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00560000",
                "pretty_value": "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3245
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070048"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3246
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3247
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000424"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3248
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000424"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3249
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000424"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00/\\x10\\x8cR\\xe2\\xd3\\xc3\\xcf\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3250
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 3251
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00090064"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "R\\xbd\\xbb\\x88\\xda\\xbb\\x88\\x90\\xff\\x8f\\x01\\x00\\x00\\x00\\x00\\x00\\xff1\\x00\\x00\\x00\\x00\\x00\\x00\\xa5\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\xaa\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3252
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3253
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3254
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 3255
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3256
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-300300000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3257
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1400",
                "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY"
              },
              {
                "name": "InBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xd6\\xbf\\xd5"
              },
              {
                "name": "OutBuffer",
                "value": " \\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00!\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x0b\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3258
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00560000",
                "pretty_value": "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3259
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070048"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3260
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3261
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3262
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000043c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x1c}\\xd5\\xe0^\\x00\\x00 \\x9dW\\x85\\xb6\\x02\\x00\\x00\\xa0\\x99O\\x85\\xb6\\x02\\x00\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x1c|\\x85\\xee^\\x00\\x0c"
              }
            ],
            "repeated": 0,
            "id": 3263
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000043c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00/\\x10\\x8cR\\xe2\\xd3\\xc3\\xcf\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3264
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3265
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00090064"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "&\\x00\\xbc\\x12>\\xbc\\x12\\xfc\\x9dAm\\x07\\x00\\x00\\x00\\x003\\xa8\\xed\\x00\\x00\\x00\\x00\\x00\\x06\\xc3\\xa3\\x00\\x00\\x00\\x00\\x00h/\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x8a\\x0c\\x00\\x00\\x00\\x00\\x00 \\xc8\\x0c\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3266
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3267
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3268
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3269
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3270
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100081",
                "pretty_value": "FILE_READ_ACCESS|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3271
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1400",
                "pretty_value": "IOCTL_STORAGE_QUERY_PROPERTY"
              },
              {
                "name": "InBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xd6\\xbf\\xd5"
              },
              {
                "name": "OutBuffer",
                "value": " \\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00!\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x0b\\x00\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3272
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00560000",
                "pretty_value": "IOCTL_VOLUME_GET_VOLUME_DISK_EXTENTS"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3273
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070048"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\x00\\x01\\x00\\x00\\xe0n\\x07/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3274
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3275
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PhysicalDrive0"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3276
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000434"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x1c}\\xd5\\xe0^\\x00\\x00 \\x9dW\\x85\\xb6\\x02\\x00\\x00\\xa0\\x99O\\x85\\xb6\\x02\\x00\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00W\\x1c|\\x85\\xee^\\x00\\x0c"
              }
            ],
            "repeated": 0,
            "id": 3277
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000434"
              },
              {
                "name": "IoControlCode",
                "value": "0x00070050"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00/\\x10\\x8cR\\xe2\\xd3\\xc3\\xcf\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x01\\x01\\x00\\x00\\x08\\x00\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00<\\x83\\xda\\x0e\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x01\\x00\\x00\\x98\\x01\\x00/\\x10\\x8cR\\x00\\x00\\x00\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3278
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3279
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x00090064"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x9d\\x7f\\xd7`\\x8e\\xd7`\\xca\\xff\\x0f\\x11\\x00\\x00\\x00\\x00\\x00\\xff!\\x02\\x00\\x00\\x00\\x00\\x00\\xdcU\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xb6\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xb6\\x00\\x00\\x00\\x00\\x00\\x00@\\xfa\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3280
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3281
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3282
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3283
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3284
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              }
            ],
            "repeated": 0,
            "id": 3285
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Recovery\\Winre.wim"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3286
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE"
              }
            ],
            "repeated": 0,
            "id": 3287
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "WimValidated"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimValidated"
              }
            ],
            "repeated": 0,
            "id": 3288
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "WimHash"
              },
              {
                "name": "Data",
                "value": "\\x01\\xec\\xce\\xdbE\\xdb\\x11\\x90\\x19\\x0cS\\x1b\\xbb\r\\\\x7f\\xba\\xdd\\xc7\\xdc\\x1b\\xf06\\xaa\\x06\\xc3\\xaa'\\x9b\\xe1~\\xea"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimHash"
              }
            ],
            "repeated": 0,
            "id": 3289
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3290
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\reinfo"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7fb70000"
              }
            ],
            "repeated": 0,
            "id": 3291
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae4845",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fb70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3292
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3293
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x7ff726ae42b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3294
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3295
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x80\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff]\\xdas@\\x9e\\x9e\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x000\\xdeU\\x85\\xb6\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xe6\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xe6\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xb6\\x02\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xb4B\\xae&\\xf7\\x7f\\x00\\x00z\\x00~\\x00\\xff\\x7f\\x00\\x000\\xdeU\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3296
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3297
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3298
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3299
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3300
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x8f\\xcb\\x98\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x10@\\x00\\x00\\x00\\x00\\x00\\x00(\\xe9\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x82xO\\x85\\xb6\\x02\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xec\\x18\\x08\\xfc\\x00\\x00\\x00\\x00P\\x82\\xd7\\x98\\xff\\x7f\\x00\\x00\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\xec\\x18\\x08\\xfc\\x00\\x00\\x00\\x00=\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xbd\\xc6\\x98\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x03\\x00e\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00=\\x00\\x00\\x00z\\x00\\x00\\x00z\\x00\\x00\\x00=\\x00\\x00\\x004\\x00\\x00\\x00z\\x00\\x90\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3301
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3302
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3303
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xea\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00|\\x00\\x00\\x00\\x00\\x00\\x8d\\xd7s@\\x9e\\x9e\\x00\\x00\\x90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xeb\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x10\\xb2[\\x85\\xb6\\x02\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\xf9\\xea\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00pP\\x96\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00|\\x00|\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x00~\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3304
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3305
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3306
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3307
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x80\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\xb0\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff]\\xdas@\\x9e\\x9e\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00\\xd0\\x93[\\x85\\xb6\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xe6\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xe6\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x00j\\x00\\x00\\x00\\x00\\x00\\xd0\\x93[\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xe5\\xbf\\xd5\\xdd\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3308
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3309
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3310
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3311
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3312
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3313
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3314
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3315
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xea\\xbf\\xd5\\xdd\\x00\\x00\\x00z\\x00|\\x00\\x00\\x00\\x00\\x00\\x8d\\xd7s@\\x9e\\x9e\\x00\\x00\\x90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xeb\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x10\\xb2[\\x85\\xb6\\x02\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\xf9\\xea\\xbf\\xd5\\xdd\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00pP\\x96\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x01\\x00\\x00\\x00W\\x00\\x00\\x00\\x04\\x01\\x00\\x00\\x00\\x00\\x00\\x00h\\x00j\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x92X\\x85\\xb6\\x02\\x00\\x00h\\x00j\\x00\\x00\\x00\\x00\\x00\\xf0\\x91X\\x85\\xb6\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3316
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3317
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3318
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3319
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3320
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3321
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00"
              }
            ],
            "repeated": 0,
            "id": 3322
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3323
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3324
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xba\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3325
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xba\\x00\\x00\\x00\\x01\\x00\\x00\\x00Z\\x00\\x00\\x00`\\x00\\x00\\x00 \\x00\\x00\\x00\\x0c\\x00\\x00\\x00,\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x00\\xc0\\xdd\\x0e\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x003\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 3326
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae42b4",
            "parentcaller": "0x7ff726ae4467",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3327
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae447e",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveGetStatusW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8a28f0"
              }
            ],
            "repeated": 0,
            "id": 3328
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3329
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3330
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\GLOBALROOT\\device\\harddisk0\\partition3"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3331
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x455610d4"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x10\\x00\"\\x00\\x10\\x00\\x12\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00\\\\x003\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3332
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3333
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\3\\SEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3334
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\BitLocker\\Volume\\3\\HEI"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3335
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\GLOBALROOT\\device\\harddisk0\\partition3\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3336
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3337
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000046c"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3338
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 3339
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00&4\\x96\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3340
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3341
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000043c"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3342
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3343
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561083"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x80\\x00\\x00\\x01\\x00\\x00\\x000\\x00\\x00\\x00\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x04X\\xcd\\xf1\\xee\\xdc\\x01,\\x00\\x08\\x00\n\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\xa3+gg\\x07\\x84\\xc0V\\xbc%*3(\\xf7\\x13d\\xff \\x15K\\x01\\x9e\\x90\\xe3j\\xe8\\xaac\\xeaw\\x896\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3344
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3345
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000043c"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d148c"
              },
              {
                "name": "InBuffer",
                "value": " \\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3346
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3347
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000470"
              },
              {
                "name": "IoControlCode",
                "value": "0x45561088"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xe8\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00\\x00\\x00 \"\\x00\\x00\\x00\\x00&4\\x96\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3348
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000043c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3349
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000043c"
              },
              {
                "name": "IoControlCode",
                "value": "0x002d1480"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3350
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 3351
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 3352
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae449b",
            "parentcaller": "0x7ff726ae4860",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 3353
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48a9",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "fveapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8d860000"
              },
              {
                "name": "FunctionName",
                "value": "FveCheckTpmCapability"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8d8a3b80"
              }
            ],
            "repeated": 0,
            "id": 3354
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48be",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "90"
              }
            ],
            "repeated": 0,
            "id": 3355
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48be",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0000000",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE"
              },
              {
                "name": "FileName",
                "value": "\\??\\TPM"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3356
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48be",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": false,
            "return": "0xffffffffc0000008",
            "pretty_return": "INVALID_HANDLE",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3357
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae3db9",
            "parentcaller": "0x7ff726ae48e1",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490c50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#60"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3358
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 3359
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 3360
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 3361
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3362
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3363
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\fveapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8d860000"
              }
            ],
            "repeated": 0,
            "id": 3364
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3365
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3366
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 3367
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96050000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3368
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              }
            ],
            "repeated": 0,
            "id": 3369
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3370
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3371
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tbs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e460000"
              }
            ],
            "repeated": 0,
            "id": 3372
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\imagehlp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98560000"
              }
            ],
            "repeated": 0,
            "id": 3373
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3374
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3375
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ae48eb",
            "parentcaller": "0x7ff726ae5fe8",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8d860000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 3376
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "WMI_ExecQuery",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Query",
                "value": "SELECT HypervisorPresent FROM Win32_ComputerSystem"
              },
              {
                "name": "QueryLanguage",
                "value": "WQL"
              }
            ],
            "repeated": 0,
            "id": 3377
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3378
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3379
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3380
          },
          {
            "timestamp": "2026-05-28 22:32:01,383",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3381
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7d79",
            "parentcaller": "0x7ff726ad7cbb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3382
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 3383
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3384
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad6eb4",
            "parentcaller": "0x7ff726ad7d8e",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 3385
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3386
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3387
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7e5e",
            "parentcaller": "0x7ff726adafb5",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3388
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3389
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3390
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3391
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7bb9",
            "parentcaller": "0x7ff726ad7b44",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3392
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad70b0",
            "parentcaller": "0x7ff726ad7641",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HypervisorPresent"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "Win32_ComputerSystem"
              }
            ],
            "repeated": 0,
            "id": 3393
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726ad7661",
            "parentcaller": "0x7ff726ae6036",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3394
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726adac85",
            "parentcaller": "0x7ff726adc397",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b80",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#31"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3395
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726adaa90",
            "parentcaller": "0x00000000",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010608"
              },
              {
                "name": "Message",
                "value": "0x00000401"
              }
            ],
            "repeated": 0,
            "id": 3396
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "9544",
            "caller": "0x7ff726adaab3",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3397
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3398
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "2404",
            "caller": "0x7ff726aecedb",
            "parentcaller": "0x7ff726af0287",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b50",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#28"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3399
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "2404",
            "caller": "0x7ff726aee88a",
            "parentcaller": "0x7ff726aea557",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#24"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3400
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "2404",
            "caller": "0x7ff726aed76b",
            "parentcaller": "0x7ff726aed8dc",
            "category": "misc",
            "api": "SystemParametersInfoW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "Action",
                "value": "0x00000042"
              },
              {
                "name": "uiParam",
                "value": "0x00000010"
              }
            ],
            "repeated": 0,
            "id": 3401
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "2404",
            "caller": "0x7ff726aee88a",
            "parentcaller": "0x7ff726aed0f8",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x2b685490b10",
            "arguments": [
              {
                "name": "Module",
                "value": "0x00000000"
              },
              {
                "name": "Type",
                "value": "#6"
              },
              {
                "name": "Name",
                "value": "#24"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3402
          },
          {
            "timestamp": "2026-05-28 22:32:01,399",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 10,
            "id": 3403
          },
          {
            "timestamp": "2026-05-28 22:32:03,289",
            "thread_id": "2404",
            "caller": "0x7ff726af00d9",
            "parentcaller": "0x7ff726af05c5",
            "category": "windows",
            "api": "PostMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "WindowHandle",
                "value": "0x00010608"
              },
              {
                "name": "Message",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3404
          },
          {
            "timestamp": "2026-05-28 22:32:03,289",
            "thread_id": "2404",
            "caller": "0x7ff726af0589",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 3405
          },
          {
            "timestamp": "2026-05-28 22:32:03,289",
            "thread_id": "2404",
            "caller": "0x7ff726af05f8",
            "parentcaller": "0x7ff726af095c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 3406
          },
          {
            "timestamp": "2026-05-28 22:32:03,289",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "mscoree.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3407
          },
          {
            "timestamp": "2026-05-28 22:32:03,289",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3408
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 3409
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              }
            ],
            "repeated": 0,
            "id": 3410
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 3411
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000380"
              }
            ],
            "repeated": 0,
            "id": 3412
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 0,
            "id": 3413
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 3414
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 3415
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 3416
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 3417
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 3418
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 3419
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000444"
              }
            ],
            "repeated": 0,
            "id": 3420
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3421
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3422
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 3423
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96551090"
              }
            ],
            "repeated": 1,
            "id": 3424
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3425
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3426
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000420"
              }
            ],
            "repeated": 0,
            "id": 3427
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3428
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3429
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 3430
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000408"
              }
            ],
            "repeated": 0,
            "id": 3431
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3432
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3433
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwUnregisterTraceGuids"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0340"
              }
            ],
            "repeated": 0,
            "id": 3434
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 3435
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000404"
              }
            ],
            "repeated": 0,
            "id": 3436
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 3437
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 3438
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwUnregisterTraceGuids"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0340"
              }
            ],
            "repeated": 0,
            "id": 3439
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 3440
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a0"
              }
            ],
            "repeated": 0,
            "id": 3441
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3442
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3443
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000394"
              }
            ],
            "repeated": 0,
            "id": 3444
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 0,
            "id": 3445
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 3446
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 3447
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 3448
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 3449
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 3450
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3451
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3452
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000324"
              }
            ],
            "repeated": 0,
            "id": 3453
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000328"
              }
            ],
            "repeated": 0,
            "id": 3454
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3455
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3456
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 3457
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 3458
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 3459
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 3460
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 3461
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 3462
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 3463
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 3464
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 3465
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68a6f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3466
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 3467
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3468
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3469
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a4"
              }
            ],
            "repeated": 0,
            "id": 3470
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 3471
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 3472
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 3473
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 3474
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 3475
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 3476
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000278"
              }
            ],
            "repeated": 0,
            "id": 3477
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 3478
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 3479
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              }
            ],
            "repeated": 0,
            "id": 3480
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 3481
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 3482
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3483
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3484
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 3485
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3486
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3487
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000214"
              }
            ],
            "repeated": 0,
            "id": 3488
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000021c"
              }
            ],
            "repeated": 0,
            "id": 3489
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              }
            ],
            "repeated": 0,
            "id": 3490
          },
          {
            "timestamp": "2026-05-28 22:32:03,305",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "MSVCRT.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98030000"
              }
            ],
            "repeated": 0,
            "id": 3491
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 3492
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 3493
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              }
            ],
            "repeated": 0,
            "id": 3494
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 3495
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000238"
              }
            ],
            "repeated": 0,
            "id": 3496
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000023c"
              }
            ],
            "repeated": 0,
            "id": 3497
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              }
            ],
            "repeated": 0,
            "id": 3498
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              }
            ],
            "repeated": 0,
            "id": 3499
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3500
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3501
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3502
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855dd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3503
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3504
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b685577000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3505
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68551e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3506
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b68556b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3507
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b6855da000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 3508
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 3509
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              }
            ],
            "repeated": 0,
            "id": 3510
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b688440000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3511
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002cc"
              }
            ],
            "repeated": 0,
            "id": 3512
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001c8"
              }
            ],
            "repeated": 0,
            "id": 3513
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001cc"
              }
            ],
            "repeated": 0,
            "id": 3514
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001c4"
              }
            ],
            "repeated": 0,
            "id": 3515
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001b8"
              }
            ],
            "repeated": 0,
            "id": 3516
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000019c"
              }
            ],
            "repeated": 0,
            "id": 3517
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001a0"
              }
            ],
            "repeated": 0,
            "id": 3518
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000198"
              }
            ],
            "repeated": 0,
            "id": 3519
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000180"
              }
            ],
            "repeated": 0,
            "id": 3520
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000184"
              }
            ],
            "repeated": 0,
            "id": 3521
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000188"
              }
            ],
            "repeated": 0,
            "id": 3522
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000018c"
              }
            ],
            "repeated": 0,
            "id": 3523
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000190"
              }
            ],
            "repeated": 0,
            "id": 3524
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000194"
              }
            ],
            "repeated": 0,
            "id": 3525
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff986c1000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3526
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff986c1000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3527
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000178"
              }
            ],
            "repeated": 0,
            "id": 3528
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000017c"
              }
            ],
            "repeated": 0,
            "id": 3529
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000174"
              }
            ],
            "repeated": 0,
            "id": 3530
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3531
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3532
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000158"
              }
            ],
            "repeated": 0,
            "id": 3533
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000015c"
              }
            ],
            "repeated": 0,
            "id": 3534
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000160"
              }
            ],
            "repeated": 0,
            "id": 3535
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000164"
              }
            ],
            "repeated": 0,
            "id": 3536
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000168"
              }
            ],
            "repeated": 0,
            "id": 3537
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000170"
              }
            ],
            "repeated": 0,
            "id": 3538
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000016c"
              }
            ],
            "repeated": 0,
            "id": 3539
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000138"
              }
            ],
            "repeated": 0,
            "id": 3540
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000013c"
              }
            ],
            "repeated": 0,
            "id": 3541
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000134"
              }
            ],
            "repeated": 0,
            "id": 3542
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ac"
              }
            ],
            "repeated": 0,
            "id": 3543
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000130"
              }
            ],
            "repeated": 0,
            "id": 3544
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000128"
              }
            ],
            "repeated": 0,
            "id": 3545
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000012c"
              }
            ],
            "repeated": 0,
            "id": 3546
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000124"
              }
            ],
            "repeated": 0,
            "id": 3547
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000120"
              }
            ],
            "repeated": 0,
            "id": 3548
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000011c"
              }
            ],
            "repeated": 0,
            "id": 3549
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e6"
              }
            ],
            "repeated": 0,
            "id": 3550
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 3551
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000f8"
              }
            ],
            "repeated": 0,
            "id": 3552
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000fc"
              }
            ],
            "repeated": 0,
            "id": 3553
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000100"
              }
            ],
            "repeated": 0,
            "id": 3554
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000104"
              }
            ],
            "repeated": 0,
            "id": 3555
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000108"
              }
            ],
            "repeated": 0,
            "id": 3556
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000010c"
              }
            ],
            "repeated": 0,
            "id": 3557
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000118"
              }
            ],
            "repeated": 0,
            "id": 3558
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000114"
              }
            ],
            "repeated": 0,
            "id": 3559
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000f4"
              }
            ],
            "repeated": 0,
            "id": 3560
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000ec"
              }
            ],
            "repeated": 0,
            "id": 3561
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000f0"
              }
            ],
            "repeated": 0,
            "id": 3562
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000e4"
              }
            ],
            "repeated": 0,
            "id": 3563
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000080"
              }
            ],
            "repeated": 0,
            "id": 3564
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b4"
              }
            ],
            "repeated": 0,
            "id": 3565
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000b8"
              }
            ],
            "repeated": 0,
            "id": 3566
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000bc"
              }
            ],
            "repeated": 0,
            "id": 3567
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              }
            ],
            "repeated": 0,
            "id": 3568
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000bc"
              },
              {
                "name": "ValueName",
                "value": "DisableMetaFiles"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles"
              }
            ],
            "repeated": 0,
            "id": 3569
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000bc"
              }
            ],
            "repeated": 0,
            "id": 3570
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize"
              }
            ],
            "repeated": 0,
            "id": 3571
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000bc"
              },
              {
                "name": "ValueName",
                "value": "DisableUmpdBufferSizeCheck"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck"
              }
            ],
            "repeated": 0,
            "id": 3572
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000bc"
              }
            ],
            "repeated": 0,
            "id": 3573
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x2b689490000"
              },
              {
                "name": "RegionSize",
                "value": "0x01260000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3574
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              }
            ],
            "repeated": 0,
            "id": 3575
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 3576
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000009c"
              }
            ],
            "repeated": 0,
            "id": 3577
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000a0"
              }
            ],
            "repeated": 0,
            "id": 3578
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000000a8"
              }
            ],
            "repeated": 0,
            "id": 3579
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3580
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001d8"
              }
            ],
            "repeated": 0,
            "id": 3581
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000094"
              }
            ],
            "repeated": 0,
            "id": 3582
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3583
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3584
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000064"
              }
            ],
            "repeated": 0,
            "id": 3585
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000044"
              }
            ],
            "repeated": 0,
            "id": 3586
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000005c"
              }
            ],
            "repeated": 0,
            "id": 3587
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000060"
              }
            ],
            "repeated": 0,
            "id": 3588
          },
          {
            "timestamp": "2026-05-28 22:32:03,321",
            "thread_id": "2404",
            "caller": "0x7ff726af13b0",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3589
          }
        ],
        "threads": [
          "2404",
          "6572",
          "8132",
          "5980",
          "6468",
          "9544",
          "9668",
          "9680",
          "9684"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Windows\\system32\\msinfo32.exe\" ",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff726ad0000",
          "MainExeSize": "0x00067000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 9420,
        "process_name": "WmiPrvSE.exe",
        "parent_id": 840,
        "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "first_seen": "2026-05-28 22:32:00,626",
        "calls": [
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "2516",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dfe9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c5608469",
            "parentcaller": "0x7ff7c5607ec1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dfea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001e8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1ff50000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ab94f680"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\SystemResources\\USER32.dll.mun"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dfec000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c99f",
            "parentcaller": "0x7ff7c560c762",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001e8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\USER32.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c99f",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001ec"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e700000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ab94eb00"
              },
              {
                "name": "ViewSize",
                "value": "0x00005000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\rpcss.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00143000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00143000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000228"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000230"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00082000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000023c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dfee000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dff4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c60b",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c60b",
            "parentcaller": "0x7ff7c560b501",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c2ca",
            "parentcaller": "0x7ff7c560b513",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e730000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ab94fab0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e5b7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000288",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8bf64f50"
              },
              {
                "name": "Parameter",
                "value": "0x1bf1dff79f0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10276"
              },
              {
                "name": "ProcessId",
                "value": "9420"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dffa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb82000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb83000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dffb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dffc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb86000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1dffe000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e000000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fb8b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b555",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b555",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b555",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "10292",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002c4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "10292",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e00d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "10292",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e00f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:32:00,672",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BC3F05E-D86B-11D0-A075-00C04FB68820"
              },
              {
                "name": "ClsContext",
                "value": "0x00000014",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e015000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "1716",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "1716",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "1716",
            "caller": "0x7ff7c560b1d8",
            "parentcaller": "0x7ff7c560b33c",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002dc",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff7c560b120"
              },
              {
                "name": "Parameter",
                "value": "0x1bf1e016a50"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10324"
              },
              {
                "name": "ProcessId",
                "value": "9420"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10324",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e019000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000310"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e01e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e020000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e021000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e024000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8be60000"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wmiutils.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8be60000"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000320"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c5601cb2",
            "parentcaller": "0x7ff7c5601a68",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e02d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c5601cb2",
            "parentcaller": "0x7ff7c5601a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c5601cb2",
            "parentcaller": "0x7ff7c5601a68",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e02e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:32:00,688",
            "thread_id": "10296",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e031000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:32:00,704",
            "thread_id": "10296",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e033000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:32:00,704",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\powrprof"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:32:00,704",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\framedynos"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a6d0000"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:32:00,704",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\cimwin32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a730000"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:32:00,704",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\UMPDC"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96170000"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\cimwin32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3a730000"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "D63A5850-8F16-11CF-9F47-00AA00BF345C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c560998d",
            "parentcaller": "0x7ff7c560899b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c5607ab2",
            "parentcaller": "0x7ff7c5605b48",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c560e7c7",
            "parentcaller": "0x7ff7c560e590",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e036000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e039000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c560f72f",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e03c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e03e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e040000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e051000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e057000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winbrand.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000314"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91070000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00035000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\winbrand"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91070000"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000314"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ac0fb560"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wldp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e05a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000314"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ac0fb560"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wldp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e05c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000314"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ac0fbe50"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wldp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000324"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\basebrd.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000314"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0016a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ac0fbe50"
              },
              {
                "name": "ViewSize",
                "value": "0x00002000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wldp.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:32:00,719",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x0016a000"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SECURITY"
              },
              {
                "name": "DllBase",
                "value": "0x1bf1fc80000"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "SECURITY.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc80000"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000314"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\secur32.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000324"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff87320000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SECUR32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff87320000"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e05f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\schannel"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95240000"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\schannel.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95240000"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000344",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff3a73d930"
              },
              {
                "name": "Parameter",
                "value": "0x7fff3a924460"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10432"
              },
              {
                "name": "ProcessId",
                "value": "9420"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10432",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e062000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e063000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fc90000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e066000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fba3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000003a4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fba4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e069000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "NTDLL.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fba5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbae000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbbf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbe0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00041000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e06f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e072000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e075000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e078000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e07b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e07e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e081000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e084000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e087000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e088000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e08b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e08e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e091000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e094000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e097000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e09a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00025000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604895",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604895",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20290000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604895",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20294000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c56048d0",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e071000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c56048d0",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e071000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e0bd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20297000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:32:00,735",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20291000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbe8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00038000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf202da000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e05d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20291000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETAPI32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "NETAPI32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff85400000"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\samcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003b8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8c070000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SAMCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8c070000"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\srvcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8cec0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00028000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SRVCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8cec0000"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\netutils.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003c4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95850000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\NETUTILS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95850000"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\logoncli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95800000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00043000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\LOGONCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95800000"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\schedcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003cc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8be20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\SCHEDCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8be20000"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003c8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wkscli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003d0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95490000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00019000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WKSCLI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95490000"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dsrole.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff917a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DSROLE"
              },
              {
                "name": "DllBase",
                "value": "0x7fff917a0000"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wkscli.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95490000"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\wkssvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\wkssvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\wkssvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003e0"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\wkssvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08h\\xff\\x1d\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\cscapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82eb0000"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:32:00,751",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "cscapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82eb0000"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f8"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f8"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f8"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x008i\\xff\\x1d\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f4"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x008i\\xff\\x1d\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003ec"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fcb0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ac0fbb50"
              },
              {
                "name": "ViewSize",
                "value": "0x00003000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:32:00,782",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff980d0000"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c56118b3",
            "parentcaller": "0x7ff7c561158d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e071000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c56118b3",
            "parentcaller": "0x7ff7c561158d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e081000"
              },
              {
                "name": "RegionSize",
                "value": "0x00017000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c56118b3",
            "parentcaller": "0x7ff7c561158d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1e0bd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wtsapi32.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00014000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wtsapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91fe0000"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003f0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ff0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0005b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WINSTA"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ff0000"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\cfgmgr32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96af0000"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\DEVOBJ"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "DEVOBJ.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96050000"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\WMI"
              },
              {
                "name": "DllBase",
                "value": "0x1bf1fcc0000"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "WMI.DLL"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fcc0000"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wmiclnt.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000003f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90640000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00011000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:32:00,797",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wmiclnt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90640000"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000003f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\WMIDataDevice"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "POWRPROF.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96190000"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xca\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xca\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\xc6\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemInfo.Ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemLogo.Bmp"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:32:00,813",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:32:01,157",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:32:01,157",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:32:01,172",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000020",
                "pretty_value": "FILE_ATTRIBUTE_ARCHIVE"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02100080",
                "pretty_value": "MAXIMUM_ALLOWED|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000404"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000404"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:32:01,188",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000414"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf202d9000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c5601cb2",
            "parentcaller": "0x7ff7c5601a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:32:01,204",
            "thread_id": "10296",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\PROVTHRD"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a670000"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95450000"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff905b0000"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\ntevt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d0b0000"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\ntevt.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d0b0000"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "FD4F53E0-65DC-11D1-AB64-00C04FD9159E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c560998d",
            "parentcaller": "0x7ff7c560899b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:32:01,219",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 2,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbe9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tzres"
              },
              {
                "name": "DllBase",
                "value": "0x1bf1fce0000"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "tzres.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000420"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fcf0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ac0fc4b0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tzres"
              },
              {
                "name": "DllBase",
                "value": "0x1bf1fce0000"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fcf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:32:01,235",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20317000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xda\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000045c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\xcc\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xca\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemInfo.Ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:32:01,251",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemLogo.Bmp"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c5601cb2",
            "parentcaller": "0x7ff7c5601a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Win32_DeviceGuard"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8be10000"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Win32_DeviceGuard.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8be10000"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\miutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8bdb0000"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\mi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8be30000"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:32:01,266",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wmitomi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff59060000"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wmitomi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff59060000"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "71F3A4A2-DC3F-4AD1-A1AD-81E2109D4414"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c560998d",
            "parentcaller": "0x7ff7c560899b",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1108BE51-F58A-4CDA-BB99-7A0227D11D5E"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000001-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7fff7fc4a4f0",
            "parentcaller": "0x7fff7fc4a195",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "DC12A687-737F-11CF-884D-00AA004B2E24"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "WbemLocator_ConnectServer",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NetworkResource",
                "value": "root\\Microsoft\\Windows\\DeviceGuard"
              },
              {
                "name": "User",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:32:01,282",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:32:01,391",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:32:01,391",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbec000"
              },
              {
                "name": "RegionSize",
                "value": "0x00034000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20320000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\xc5\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xc7\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xc1\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemInfo.Ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:32:01,407",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemLogo.Bmp"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10292",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10292",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10292",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fba5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:32:01,422",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20329000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf2034a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10292",
            "caller": "0x7ff7c5604661",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf2034d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10292",
            "caller": "0x7ff7c5604895",
            "parentcaller": "0x7ff7c560906c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20350000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbec000"
              },
              {
                "name": "RegionSize",
                "value": "0x00034000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20390000"
              },
              {
                "name": "RegionSize",
                "value": "0x00200000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20390000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\wkssvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000047c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\wkssvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000047c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\wkssvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000047c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\wkssvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xc8\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20339000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf2034a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000478"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000478"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000478"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000478"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xcd\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xda\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf20317000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xd4\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000470"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xc8\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000420"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000420"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000420"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000420"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xce\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemInfo.Ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemLogo.Bmp"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:32:01,438",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:32:01,454",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:32:01,454",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:32:01,454",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:32:01,454",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000020",
                "pretty_value": "FILE_ATTRIBUTE_ARCHIVE"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02100080",
                "pretty_value": "MAXIMUM_ALLOWED|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000454"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\hal.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000454"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00006000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7ff7c561062f",
            "parentcaller": "0x7ff7c5610221",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100000",
                "pretty_value": "SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:32:01,469",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tzres"
              },
              {
                "name": "DllBase",
                "value": "0x1bf1fce0000"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "tzres.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\tzres.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fcf0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x2ac0fc4b0"
              },
              {
                "name": "ViewSize",
                "value": "0x0000c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\tzres"
              },
              {
                "name": "DllBase",
                "value": "0x1bf1fce0000"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fcf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000460"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xd3\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\srvsvc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000448"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\srvsvc"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88\\xd3\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\PIPE\\lsarpc"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "41",
                "pretty_value": "FileIoStatusBlockRangeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000408"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\lsass"
              },
              {
                "name": "FileInformationClass",
                "value": "30",
                "pretty_value": "FileCompletionInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\xca\\x0b\\x1e\\xbf\\x01\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100000",
                "pretty_value": "GENERIC_READ|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemInfo.Ini"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:32:01,485",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OemLogo.Bmp"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:32:01,501",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:32:01,501",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:32:01,501",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:32:01,501",
            "thread_id": "10296",
            "caller": "0x7ff7c561158d",
            "parentcaller": "0x7ff7c56111eb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1def3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:32:01,594",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:32:01,594",
            "thread_id": "10296",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:32:01,594",
            "thread_id": "10296",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff97070030",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:32:01,594",
            "thread_id": "10296",
            "caller": "0x7ff7c560906c",
            "parentcaller": "0x7ff7c5608cc3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1bf1fbf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00030000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 531
          }
        ],
        "threads": [
          "2516",
          "1716",
          "10292",
          "10324",
          "10296",
          "10432"
        ],
        "environ": {
          "UserName": "JOHNS-PC$",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff7c5600000",
          "MainExeSize": "0x0007e000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 10576,
        "process_name": "WmiPrvSE.exe",
        "parent_id": 840,
        "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "first_seen": "2026-05-28 22:32:00,986",
        "calls": [
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ncobjapi"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8bf60000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8bf65be0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10708",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c677c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10716",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10716",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f72030"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10708",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10708",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71a00"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10720",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e06649a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10720",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10720",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71ed0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10712",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10712",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71e10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c5612cd1",
            "parentcaller": "0x7ff7c561264a",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff7c5612c80"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56136d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56136d5",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c5608469",
            "parentcaller": "0x7ff7c5607ec1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e06649b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f9ae",
            "parentcaller": "0x7ff7c5608019",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WBEM\\CIMOM"
              },
              {
                "name": "Handle",
                "value": "0x00000200"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f9f5",
            "parentcaller": "0x7ff7c5608019",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              },
              {
                "name": "ValueName",
                "value": "Sink Transmit Buffer Size"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560fa06",
            "parentcaller": "0x7ff7c5608019",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f8ba",
            "parentcaller": "0x7ff7c560801e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Wbem\\Cimom"
              },
              {
                "name": "Handle",
                "value": "0x00000200"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Cimom"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f906",
            "parentcaller": "0x7ff7c560801e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              },
              {
                "name": "ValueName",
                "value": "DefaultRpcStackSize"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f91f",
            "parentcaller": "0x7ff7c560801e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca03",
            "parentcaller": "0x7ff7c560c74d",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x1e0664720e4",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000080"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b5a190"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b70170"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000200"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000200"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0684b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xd783bef7a0"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560ca74",
            "parentcaller": "0x7ff7c560c74d",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000200"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c561307c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c561307c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56134c8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56134c8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c561342b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c561342b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613314",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613314",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a9000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "USER32"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#14"
              },
              {
                "name": "Name",
                "value": "#32513"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "misc",
            "api": "FindResourceExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#22"
              },
              {
                "name": "Name",
                "value": "#32513"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c96b",
            "parentcaller": "0x7ff7c560c762",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e06649d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5612ff1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5612ff1",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613107",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613107",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c99f",
            "parentcaller": "0x7ff7c560c762",
            "category": "misc",
            "api": "FindResourceExW",
            "status": true,
            "return": "0x1e066bf07d0",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "Type",
                "value": "#4"
              },
              {
                "name": "Name",
                "value": "#16"
              },
              {
                "name": "Language",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c99f",
            "parentcaller": "0x7ff7c560c762",
            "category": "misc",
            "api": "LoadResource",
            "status": true,
            "return": "0x1e066bf1190",
            "arguments": [
              {
                "name": "Module",
                "value": "0x7fff97d60000"
              },
              {
                "name": "ResourceInfo",
                "value": "0x1e066bf07d0"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56135f0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56135f0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "10580"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000240"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000240"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000244"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9421f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94213f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000001f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00082000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f8"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000214"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000214"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000214"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000214"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000214"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:32:01,048",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000214"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000214"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000244"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "v\\xfc\\xf9\\xaf*\\xca\\xd7^_0\\xffah\\xedACM\rx\\xd0.\\x82KIC\\x1c\\xb8X\\x8b\\x12\\xa5U\\x81\\xcd\\xf7\\xe1\\xbd~\\xbf\\xd4\\xd9\\x10\\xfe\\xa3W\\xc3\\xd6\\xd9"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96c58b60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c378",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e06649e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000250"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000250"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000250"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000250"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664a4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x00000250"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xf2\\xbe\\x83\\xd7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xd7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00v\\xa2\\x00\\x97\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xe0\\xf2\\xbe\\x83\\xd7\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-18_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Classes"
              },
              {
                "name": "Handle",
                "value": "0x00000254"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "AppID\\wmiprvse.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\wmiprvse.exe"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64GetCurrentMachine"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d90"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "LdrGetProcedureAddress",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlWow64IsWowGuestMachineSupported"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccc670"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "AppID\\wmiprvse.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\wmiprvse.exe"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xf7\\xbe\\x83\\xd7\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xff\\xff\\xff\\xffP\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6CP\\x96\\xff\\x7f\\x00\\x00\\xf0j6V\\xb2\\xff\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c5a5",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c60b",
            "parentcaller": "0x7ff7c560b501",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c60b",
            "parentcaller": "0x7ff7c560b501",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c297",
            "parentcaller": "0x7ff7c560b513",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000006"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\Wmi Provider Sub System Counters"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c2ca",
            "parentcaller": "0x7ff7c560b513",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000284"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e068140000"
              },
              {
                "name": "SectionOffset",
                "value": "0xd783befbd0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e066b47000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "EventName",
                "value": "WBEM_ESS_OPEN_FOR_BUSINESS"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000029c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff8bf64f50"
              },
              {
                "name": "Parameter",
                "value": "0x1e0664a8320"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "10796"
              },
              {
                "name": "ProcessId",
                "value": "10576"
              },
              {
                "name": "Module",
                "value": "NCObjAPI.DLL"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1b9",
            "parentcaller": "0x7ff7c560b518",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000029c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff8bf64f50"
              },
              {
                "name": "Parameter",
                "value": "0x1e0664a8320"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10796"
              },
              {
                "name": "ProcessId",
                "value": "10576"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0687f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0687f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664ab000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10796",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0687f2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0687f3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10796",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10796",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff8bf64f50"
              },
              {
                "name": "Parameter",
                "value": "0x1e0664a8320"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664ad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0687f6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664b1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560c1ff",
            "parentcaller": "0x7ff7c560b518",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0687fb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b555",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemprox"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b555",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82dc0000"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b555",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F811-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613553",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613553",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b574",
            "parentcaller": "0x7ff7c560c77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b574",
            "parentcaller": "0x7ff7c560c77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "wmisvc.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82dce000"
              },
              {
                "name": "ModuleName",
                "value": "wbemprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82dce000"
              },
              {
                "name": "ModuleName",
                "value": "wbemprox.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "misc",
            "api": "GetComputerNameExW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ComputerName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "misc",
            "api": "GetComputerNameExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002c0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x1e066497e00"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10808"
              },
              {
                "name": "ProcessId",
                "value": "10576"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10808",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10808",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x1e066497e00"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10808",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664ba000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10812",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10812",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x1e066470b50"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10812",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002dc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10812",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664bf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10812",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10816",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10816",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x1e066470b50"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wbemsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wbemsvc.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a50000"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8BC3F05E-D86B-11D0-A075-00C04FB68820"
              },
              {
                "name": "ClsContext",
                "value": "0x00000014",
                "pretty_value": "CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:32:01,064",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "misc",
            "api": "GetComputerNameExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "misc",
            "api": "GetComputerNameExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-l1-2-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-obsolete-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetThreadPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96546320"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "SetThreadPreferredUILanguages"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964e9c20"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LocaleNameToLCID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96540070"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetLocaleInfoEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964f0210"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LCIDToLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964eae60"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetSystemDefaultLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96556890"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025c"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025c"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025c"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f8"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\fastprox.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fc20000"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7fc20000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7fc20000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7fc48e90"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7fc20000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7fc20000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7fc48de0"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:10576:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b5bc",
            "parentcaller": "0x7ff7c560c77a",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fd28000"
              },
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7fd28000"
              },
              {
                "name": "ModuleName",
                "value": "FastProx.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a61000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a61000"
              },
              {
                "name": "ModuleName",
                "value": "wbemsvc.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WBEM\\CIMOM"
              },
              {
                "name": "Handle",
                "value": "0x000002c0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              },
              {
                "name": "ValueName",
                "value": "EnableObjectValidation"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dafb",
            "parentcaller": "0x7ff7c560b615",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dc61",
            "parentcaller": "0x7ff7c560db18",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClearAfter"
              },
              {
                "name": "Value",
                "value": "00000000000030.000000:000"
              },
              {
                "name": "Class",
                "value": "__ObjectProviderCacheControl"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560db93",
            "parentcaller": "0x7ff7c560b615",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560dc61",
            "parentcaller": "0x7ff7c560dbb0",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClearAfter"
              },
              {
                "name": "Value",
                "value": "00000000000030.000000:000"
              },
              {
                "name": "Class",
                "value": "__EventProviderCacheControl"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c5601167",
            "parentcaller": "0x7ff7c560b67e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c5601383",
            "parentcaller": "0x7ff7c560117a",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ThreadsPerHost"
              },
              {
                "name": "Value",
                "value": "256"
              },
              {
                "name": "Class",
                "value": "__ProviderHostQuotaConfiguration"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c56013fc",
            "parentcaller": "0x7ff7c560117a",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HandlesPerHost"
              },
              {
                "name": "Value",
                "value": "4096"
              },
              {
                "name": "Class",
                "value": "__ProviderHostQuotaConfiguration"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c5601471",
            "parentcaller": "0x7ff7c560117a",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ProcessLimitAllHosts"
              },
              {
                "name": "Value",
                "value": "32"
              },
              {
                "name": "Class",
                "value": "__ProviderHostQuotaConfiguration"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b1d8",
            "parentcaller": "0x7ff7c560b33c",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff7c560b120"
              },
              {
                "name": "Parameter",
                "value": "0x1e0664c9d50"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "10840"
              },
              {
                "name": "ProcessId",
                "value": "10576"
              },
              {
                "name": "Module",
                "value": "wmiprvse.exe"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b1d8",
            "parentcaller": "0x7ff7c560b33c",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002f8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff7c560b120"
              },
              {
                "name": "Parameter",
                "value": "0x1e0664c9d50"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "10840"
              },
              {
                "name": "ProcessId",
                "value": "10576"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560b350",
            "parentcaller": "0x7ff7c560b763",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10840",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10840",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff7c560b120"
              },
              {
                "name": "Parameter",
                "value": "0x1e0664c9d50"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10840",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613277",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10840",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c5613277",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025c"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}"
              },
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000031c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000031c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000031c"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WMI Provider Subsystem Host"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000031c"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000031c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000031c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000031c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000031c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xbcLf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xbeLf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "H*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xacKf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x90}6V\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xe0\\xed\\xbe\\x83\\xd7\\x00\\x00\\x00\\xd8\\xed\\xbe\\x83\\xd7\\x00\\x00\\x00\\xa8\\xed\\xbe\\x83\\xd7\\x00\\x00\\x00\\xc8\\xed\\xbe\\x83"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xacKf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xeb\\xbe\\x83\\xd7\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xb8Lf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xe0\\x01\\x00\\x00\\x1e\\x00\\x00\\x00\\x05\\x00\\x00\\x000\\xb8Lf\\xe0\\x01\\x00\\x00\\x12\\xa4Lf\\xe0\\x01\\x00\\x00\\xf8\\xb8Lf\\xe0\\x01\\x00\\x00^\\x01\\x00\\x00^\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xb8Lf"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xbfLf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xb0Kf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x000y6V\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xea\\xbe\\x83\\xd7\\x00\\x00\\x008\\xea\\xbe\\x83\\xd7\\x00\\x00\\x00\\x08\\xea\\xbe\\x83\\xd7\\x00\\x00\\x00(\\xea\\xbe\\x83"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xb0Kf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xe8\\xbe\\x83\\xd7\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560a124",
            "parentcaller": "0x7ff7c560b77b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664cd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56131a4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10580",
            "caller": "0x7ff7c560f292",
            "parentcaller": "0x7ff7c56131a4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff7c566c000"
              },
              {
                "name": "ModuleName",
                "value": "wmiprvse.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000328"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x06}\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff9704b0ca",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xb7Lf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xc0\\xe6\\xcc\\x7f\\xff\\x7f\\x00\\x00(\\xb7Lf\\xe0\\x01\\x00\\x00p\\xa5Lf\\xe0\\x01\\x00\\x00y\\xa5Lf\\xe0\\x01\\x00\\x00{\\xa5Lf\\xe0\\x01\\x00\\x00\\x1e\\x00\\x00\\x00\\x05\\x00\\x00\\x00H\\xb7Lf"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xbaLf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xadKf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00 [\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00P\\xcc7\\x84\\xd7\\x00\\x00\\x00H\\xcc7\\x84\\xd7\\x00\\x00\\x00\\x18\\xcc7\\x84\\xd7\\x00\\x00\\x008\\xcc7\\x84"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xadKf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xca7\\x84\\xd7\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xb6Lf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xb6Lf\\xe0\\x01\\x00\\x00X\\xdd\\xd1\\x7f\\xff\\x7f\\x00\\x00p\\xb7Lf\\xe0\\x01\\x00\\x00\\xf8\\xb7Lf\\xe0\\x01\\x00\\x00X\\xb8Lf\\xe0\\x01\\x00\\x00@\\xee\\xcc\\x7f"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xb7Lf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\xe0\\x01\\x00\\x00P\\xb7Lf\\xe0\\x01\\x00\\x00p\\xb8Lf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x05\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x9b\\xa5Lf\\xe0\\x01\\x00\\x00X\\xb7Lf"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xa5Kf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc0X\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xc87\\x84\\xd7\\x00\\x00\\x00\\xa8\\xc87\\x84\\xd7\\x00\\x00\\x00x\\xc87\\x84\\xd7\\x00\\x00\\x00\\x98\\xc87\\x84"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa5Kf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xc67\\x84\\xd7\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000032c"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000032c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xbdLf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xbcLf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xaaKf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc0T\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xd47\\x84\\xd7\\x00\\x00\\x00\\xa8\\xd47\\x84\\xd7\\x00\\x00\\x00x\\xd47\\x84\\xd7\\x00\\x00\\x00\\x98\\xd47\\x84"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xaaKf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xd27\\x84\\xd7\\x00\\x00\\x004\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "h\\xc4Lf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xbfLf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00F\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xabKf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00`P\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x10\\xd17\\x84\\xd7\\x00\\x00\\x00\\x08\\xd17\\x84\\xd7\\x00\\x00\\x00\\xd8\\xd07\\x84\\xd7\\x00\\x00\\x00\\xf8\\xd07\\x84"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xabKf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xce7\\x84\\xd7\\x00\\x00\\x004\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}"
              },
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:32:01,079",
            "thread_id": "10816",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000334"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000334"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xbaLf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xbdLf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xb0Kf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc0T\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xd47\\x84\\xd7\\x00\\x00\\x00\\xa8\\xd47\\x84\\xd7\\x00\\x00\\x00x\\xd47\\x84\\xd7\\x00\\x00\\x00\\x98\\xd47\\x84"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xb0Kf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xd27\\x84\\xd7\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xbcLf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xb9Lf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x004s\\x00\\x00P\\x01Gf\\xe0\\x01\\x00\\x00\\x80\\xa3Lf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xadKf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00`P\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x10\\xd17\\x84\\xd7\\x00\\x00\\x00\\x08\\xd17\\x84\\xd7\\x00\\x00\\x00\\xd8\\xd07\\x84\\xd7\\x00\\x00\\x00\\xf8\\xd07\\x84"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xadKf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xce7\\x84\\xd7\\x00\\x00\\x00,\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664d3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "7}\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x004}\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "C}\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00@}\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}"
              },
              {
                "name": "Handle",
                "value": "0x00000320"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000320"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000320"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xbaLf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xc5Lf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xa5Kf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00@^\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x000\\xcf7\\x84\\xd7\\x00\\x00\\x00(\\xcf7\\x84\\xd7\\x00\\x00\\x00\\xf8\\xce7\\x84\\xd7\\x00\\x00\\x00\\x18\\xcf7\\x84"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa5Kf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xcd7\\x84\\xd7\\x00\\x00\\x00\\x1c\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88\\xbfLf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xb9Lf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xaaKf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xe0[\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x90\\xcb7\\x84\\xd7\\x00\\x00\\x00\\x88\\xcb7\\x84\\xd7\\x00\\x00\\x00X\\xcb7\\x84\\xd7\\x00\\x00\\x00x\\xcb7\\x84"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xaaKf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc97\\x84\\xd7\\x00\\x00\\x00\\x1c\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}"
              },
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000031c"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000320"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000031c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\xb6Lf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xb6Lf\\xe0\\x01\\x00\\x00X\\xdd\\xd1\\x7f\\xff\\x7f\\x00\\x00p\\xb7Lf\\xe0\\x01\\x00\\x00\\xf8\\xb7Lf\\xe0\\x01\\x00\\x00X\\xb8Lf\\xe0\\x01\\x00\\x00@\\xee\\xcc\\x7f"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xc1Lf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88*Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xa3Kf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc0T\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xd47\\x84\\xd7\\x00\\x00\\x00\\xa8\\xd47\\x84\\xd7\\x00\\x00\\x00x\\xd47\\x84\\xd7\\x00\\x00\\x00\\x98\\xd47\\x84"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3Kf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xd27\\x84\\xd7\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "wG\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xabZ\t\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xb7Lf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\xc0\\xe6\\xcc\\x7f\\xff\\x7f\\x00\\x00(\\xb7Lf\\xe0\\x01\\x00\\x00p\\xa5Lf\\xe0\\x01\\x00\\x00y\\xa5Lf\\xe0\\x01\\x00\\x00{\\xa5Lf\\xe0\\x01\\x00\\x00\\x1e\\x00\\x00\\x00\\x05\\x00\\x00\\x00H\\xb7Lf"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xb8Lf\\xe0\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x05\\x00\\x00\\x000\\xb8Lf\\xe0\\x01\\x00\\x00\\x12\\xa4Lf\\xe0\\x01\\x00\\x00\\xf8\\xb8Lf\\xe0\\x01\\x00\\x00^\\x01\\x00\\x00^\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xb8Lf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08+Kf\\xe0\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xaaKf\\xe0\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00Z\\x04\\x8d\\xdf\\xf9\\xc7C\n\\xb4P\\xd4\\xe7Gz!r\\xabAp\\xf4\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00`P\\xbfQ\\xb2\\xff\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x10\\xd17\\x84\\xd7\\x00\\x00\\x00\\x08\\xd17\\x84\\xd7\\x00\\x00\\x00\\xd8\\xd07\\x84\\xd7\\x00\\x00\\x00\\xf8\\xd07\\x84"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xaaKf\\xe0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xce7\\x84\\xd7\\x00\\x00\\x00 \\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff9704b0ca",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff7fc4addd",
            "parentcaller": "0x7fff7fc4a3b7",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\wbem\\wmiutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8be60000"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wbem\\wmiutils.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8be60000"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c560f038",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "3BC15AF2-736C-477E-9E51-238AF8667DCC"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000033c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa3}\n\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\xa0}\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xaa}\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff9704b0ca",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "674B6698-EE92-11D0-AD71-00C04FD8FDFF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664de000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5601cb2",
            "parentcaller": "0x7ff7c5601a68",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5601cb2",
            "parentcaller": "0x7ff7c5601a68",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4590F812-1D3A-11D0-891F-00AA004B2E24"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c56026d3",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "3"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602765",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Name"
              },
              {
                "name": "Value",
                "value": "WmiPerfClass"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602810",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Enabled"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c56028a2",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CLSID"
              },
              {
                "name": "Value",
                "value": "{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604112",
            "parentcaller": "0x7ff7c5603c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c560415f",
            "parentcaller": "0x7ff7c5603c3a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\wbem\\WmiPerfClass.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c560417d",
            "parentcaller": "0x7ff7c5603c3a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c56041aa",
            "parentcaller": "0x7ff7c5603c3a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603d53",
            "parentcaller": "0x7ff7c5603c9f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InProcServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InProcServer32"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c56051f4",
            "parentcaller": "0x7ff7c5603d6f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604dc3",
            "parentcaller": "0x7ff7c5603d81",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": "Synchronization"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\Synchronization"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603dbc",
            "parentcaller": "0x7ff7c5603c9f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\wbem\\WmiPerfClass.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603dcc",
            "parentcaller": "0x7ff7c5603c9f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603e6b",
            "parentcaller": "0x7ff7c5603cb2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603a94",
            "parentcaller": "0x7ff7c56028ef",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603ada",
            "parentcaller": "0x7ff7c56028ef",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "WmiPerf Class Provider"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603ba4",
            "parentcaller": "0x7ff7c5603aeb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": "AppId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\AppId"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603b05",
            "parentcaller": "0x7ff7c56028ef",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602958",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ClientLoadableCLSID"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c56029ee",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "DefaultMachineName"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602a86",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UnloadTimeout"
              },
              {
                "name": "Value",
                "value": "00000000001500.000000:000"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602b25",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ImpersonationLevel"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602bbd",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsSendStatus"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602c4f",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsShutdown"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602cde",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsQuotas"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602d6d",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "OperationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602e05",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationTimeoutInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602e9d",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsThrottling"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602f2c",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": false,
            "return": "0xffffffff80041002",
            "arguments": [
              {
                "name": "Name",
                "value": "ConcurrentIndependantRequests"
              },
              {
                "name": "Value",
                "value": "Unhandled VARIANT Type: 0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5602fa6",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializationReentrancy"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603036",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InitializeAsAdminFirst"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c56030c5",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerUserInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603154",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerLocaleInitialization"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c56031e6",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Pure"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c560327a",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "HostingModel"
              },
              {
                "name": "Value",
                "value": "LocalSystemHost"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5603348",
            "parentcaller": "0x7ff7c5601cca",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SecurityDescriptor"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__Win32Provider"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{027947E1-D731-11CE-A357-000000000001}"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000340"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:32:01,095",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025c"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000340"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025c"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000340"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\wbem\\fastprox.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000340"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000340"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000340"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000025c"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000344"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000340"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000340"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604e98",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E7D35CFA-348B-485E-B524-252725D697CA"
              },
              {
                "name": "ClsContext",
                "value": "0x80000001",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_PS_DLL"
              },
              {
                "name": "riid",
                "value": "D5F569D0-593B-101A-B569-08002B2DBF7A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x00000348"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000348"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000348"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000254"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              },
              {
                "name": "Handle",
                "value": "0x0000031c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000031c"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{7C857801-7381-11CF-884D-00AA004B2E24}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5604ef3",
            "parentcaller": "0x7ff7c5601ab3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x1e0664f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640b4a",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "Version"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640be1",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsPut"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640c80",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsGet"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640d1a",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsDelete"
              },
              {
                "name": "Value",
                "value": "FALSE"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640db4",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsEnumeration"
              },
              {
                "name": "Value",
                "value": "TRUE"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640e4e",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsBatching"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640ee8",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "SupportsTransactions"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640f82",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "PerUserSchema"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c564101c",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ReSynchroniseOnNamespaceOpen"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c56410b6",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "QuerySupportLevels"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c56415e8",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "InteractionType"
              },
              {
                "name": "Value",
                "value": "0"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5641687",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ResultSetQueries"
              },
              {
                "name": "Value",
                "value": "Array"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5640983",
            "parentcaller": "0x7ff7c56416ac",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "EAC8A024-21E2-4523-AD73-A71A0AA2F56A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "81166F58-DD98-11D3-A120-00105A1F515A"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c5641717",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "UnSupportedQueries"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c56417c0",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "ReferencedSetQueries"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c56418ac",
            "parentcaller": "0x7ff7c56050dd",
            "category": "system",
            "api": "WMI_Get",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Name",
                "value": "CacheRefreshInterval"
              },
              {
                "name": "Value",
                "value": "NULL"
              },
              {
                "name": "Class",
                "value": "__ClassProviderRegistration"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\pdh"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7f2f0000"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wevtapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff905b0000"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:32:01,111",
            "thread_id": "10816",
            "caller": "0x7ff7c56056cb",
            "parentcaller": "0x7ff7c5605514",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wbem\\WmiPerfClass"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82e80000"
              }
            ],
            "repeated": 0,
            "id": 693
          }
        ],
        "threads": [
          "10580",
          "10708",
          "10716",
          "10720",
          "10712",
          "10796",
          "10808",
          "10812",
          "10816",
          "10840"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff7c5600000",
          "MainExeSize": "0x0007e000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 11832,
        "process_name": "identity_helper.exe",
        "parent_id": 7284,
        "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe",
        "first_seen": "2026-05-28 22:32:08,000",
        "calls": [
          {
            "timestamp": "2026-05-28 22:32:08,171",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98cbc295",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000060",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff52500000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff52682a60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:32:08,203",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98cbc295",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000010",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff52500000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff526dc510"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:32:08,218",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98cbc295",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000009",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff52500000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff526b5c30"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:32:08,250",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98cbc295",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000090",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff52500000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff526dc590"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:32:08,281",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98cbc295",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff52500000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff5264efd0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:32:08,296",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98cbc295",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000050",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff52500000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff526b1950"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ff156",
            "parentcaller": "0x7fff52700c0a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000008",
                "pretty_value": "PAGE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ffaa7",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-2"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ffaa7",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-fibers-l1-1-2"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ffaa7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsGetValue2"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ffaa7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ffaa7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff52629070",
            "parentcaller": "0x7fff526b2c96",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff52629070",
            "parentcaller": "0x7fff526b2c96",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff52629070",
            "parentcaller": "0x7fff526b2c96",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96c20000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff52629089",
            "parentcaller": "0x7fff526b2c96",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96c20000"
              },
              {
                "name": "FunctionName",
                "value": "ProcessPrng"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96c35010"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526b3b9c",
            "parentcaller": "0x7fff526b3d77",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000000000"
              },
              {
                "name": "RegionSize",
                "value": "0x800000000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526b3b9c",
            "parentcaller": "0x7fff526b3d77",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e82c4d30000"
              },
              {
                "name": "RegionSize",
                "value": "0x400000000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526b3c18",
            "parentcaller": "0x7fff5262b8df",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6e82c4d31000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000004000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000008000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5270006a",
            "parentcaller": "0x7fff52700c0a",
            "category": "misc",
            "api": "GetCommandLineA",
            "status": true,
            "return": "0x24abf005860",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff52700077",
            "parentcaller": "0x7fff52700c0a",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x24abf003ea6",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000018000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff6c7",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff6c7",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff6c7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LCMapStringEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964ed3c0"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff6c7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff6c7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000028000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff1d6",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff1d6",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff1d6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "AreFileApisANSI"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b70f00"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff1d6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff1d6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f000002c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000038000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f000003c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000048000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f000004c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000058000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f000005c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f000006c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000070000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000080000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5266c301",
            "parentcaller": "0x7fff526efa72",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5266c311",
            "parentcaller": "0x7fff526efa72",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "GetSystemTimePreciseAsFileTime"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b75350"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000090000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff8f9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-string-l1-1-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff8f9",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-string-l1-1-0"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff8f9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "CompareStringEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964f7130"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff8f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff8f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff922",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "EnumSystemLocalesEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96557f40"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff922",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff922",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff94b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-datetime-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ff94b",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-datetime-l1-1-1"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff94b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetDateFormatEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff965455b0"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff94b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff94b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff974",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetLocaleInfoEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964f0210"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff974",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff974",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff99d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetTimeFormatEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9654d1a0"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff99d",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff99d",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff9c6",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetUserDefaultLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9650ae80"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:32:08,343",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff9c6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff9c6",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ff9ef",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "IsValidLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964ead90"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ff9ef",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ff9ef",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ffa41",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffb27",
            "parentcaller": "0x7fff526ffa41",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-obsolete-l1-2-0"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ffa41",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LCIDToLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964eae60"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ffa41",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ffa41",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffc58",
            "parentcaller": "0x7fff526ffa6a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LocaleNameToLCID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96540070"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffbd7",
            "parentcaller": "0x7fff526ffa6a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526ffc08",
            "parentcaller": "0x7fff526ffa6a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff529af000"
              },
              {
                "name": "ModuleName",
                "value": "msedge_elf.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000098000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52677e31",
            "parentcaller": "0x7fff525fb049",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52677e31",
            "parentcaller": "0x7fff525fb049",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96c20000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52677e4a",
            "parentcaller": "0x7fff525fb049",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96c20000"
              },
              {
                "name": "FunctionName",
                "value": "ProcessPrng"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96c35010"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52670e68",
            "parentcaller": "0x7fff52670dc8",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\usp10.dll"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f000009c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266fbd4",
            "parentcaller": "0x7fff52670076",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xe4\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266fc42",
            "parentcaller": "0x7fff52670076",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x24abf003ea6",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266fcd6",
            "parentcaller": "0x7fff52670076",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266fce6",
            "parentcaller": "0x7fff52670076",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "IsWow64Process"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b6f980"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266feef",
            "parentcaller": "0x7fff526700f0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266feef",
            "parentcaller": "0x7fff526700f0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5267019b",
            "parentcaller": "0x7fff526703bc",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000201",
                "pretty_value": "KEY_QUERY_VALUE|0x00000200"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526702c2",
            "parentcaller": "0x7fff52670346",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ValueName",
                "value": "channel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526702c2",
            "parentcaller": "0x7fff52670346",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ValueName",
                "value": "channel"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "stable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526703ea",
            "parentcaller": "0x7fff526708ef",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000038000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000090000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266feef",
            "parentcaller": "0x7fff526700f0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266feef",
            "parentcaller": "0x7fff526700f0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5267019b",
            "parentcaller": "0x7fff526703bc",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000201",
                "pretty_value": "KEY_QUERY_VALUE|0x00000200"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526702c2",
            "parentcaller": "0x7fff52670346",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ValueName",
                "value": "ap"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526703ea",
            "parentcaller": "0x7fff5267195d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266feef",
            "parentcaller": "0x7fff526700f0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5266feef",
            "parentcaller": "0x7fff526700f0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5267019b",
            "parentcaller": "0x7fff526703bc",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000201",
                "pretty_value": "KEY_QUERY_VALUE|0x00000200"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526702c2",
            "parentcaller": "0x7fff52670346",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ValueName",
                "value": "name"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526702c2",
            "parentcaller": "0x7fff52670346",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ValueName",
                "value": "name"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526703ea",
            "parentcaller": "0x7fff526719ed",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000a4"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b5a190"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b70170"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000210"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000020c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3200000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95e340"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527332c9",
            "parentcaller": "0x7fff5267094e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52670fba",
            "parentcaller": "0x7fff52645699",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x24abf003ea6",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000d4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526455e1",
            "parentcaller": "0x7fff526456aa",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x24abf003ea6",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 1,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff5262ba80",
            "parentcaller": "0x7fff5262ab16",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f00000f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526bf562",
            "parentcaller": "0x7fff528775e5",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526bf562",
            "parentcaller": "0x7fff528775e5",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff528775e5",
            "parentcaller": "0x7fff528720c4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "InitializeCriticalSectionEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b74d00"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526bf3fe",
            "parentcaller": "0x7fff52872105",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\pipe\\crashpad_7284_GEGXVQJDPVSTZRQP"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526bf425",
            "parentcaller": "0x7fff52872105",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\crashpad_7284_GEGXVQJDPVSTZRQP"
              },
              {
                "name": "FileInformationClass",
                "value": "23",
                "pretty_value": "FilePipeInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff526bf9bb",
            "parentcaller": "0x7fff526bff6d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52870ad2",
            "parentcaller": "0x7fff5287213f",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7fff52871e30"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52870ae4",
            "parentcaller": "0x7fff5287213f",
            "category": "hooking",
            "api": "RtlAddVectoredExceptionHandler",
            "status": true,
            "return": "0x24abeff07e0",
            "arguments": [
              {
                "name": "First",
                "value": "1"
              },
              {
                "name": "Handler",
                "value": "0x7fff52871f50"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52672947",
            "parentcaller": "0x7fff526728b9",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52672947",
            "parentcaller": "0x7fff526728b9",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff52772986",
            "parentcaller": "0x7fff527728f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f1e2000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527729aa",
            "parentcaller": "0x7fff527728f3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f1e2000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff527729aa",
            "parentcaller": "0x7fff527728f3",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff52500000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff526dd2f0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff85ea125f",
            "parentcaller": "0x7fff9634e473",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf035000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff9653c976",
            "parentcaller": "0x7fff85eb81dc",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8607b000"
              },
              {
                "name": "ModuleName",
                "value": "dbghelp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-file-l1-2-1.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:32:08,359",
            "thread_id": "11836",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff964fe6a1",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-file-l1-2-1.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:32:08,375",
            "thread_id": "11836",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff85eb8089",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetTempPathW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96544af0"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:32:08,375",
            "thread_id": "11836",
            "caller": "0x7fff9653c976",
            "parentcaller": "0x7fff85eb826c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8607b000"
              },
              {
                "name": "ModuleName",
                "value": "dbghelp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00003000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:32:08,375",
            "thread_id": "11836",
            "caller": "0x7fff9653c976",
            "parentcaller": "0x7fff85eb826c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dbghelp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff85ea0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff85ebb1a0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:32:08,390",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98d23d4d",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x000000a0",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff61f04fba0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:32:08,406",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98d23d4d",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000080",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff61f094280"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:32:08,421",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98d23d4d",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000091",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff61f07a0e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:32:08,437",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98d23d4d",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff61f094300"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:32:08,453",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98d23d4d",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff61f035840"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11836",
            "caller": "0x7fff98c69aff",
            "parentcaller": "0x7fff98d23d4d",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000080",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7ff61f075f80"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11836",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11976",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c677c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000003c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11972",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000100000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11972",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11972",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f72030"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11968",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf024000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11968",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf105000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11968",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11968",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71e10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11976",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11976",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71ed0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11964",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf025000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11964",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000005000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11964",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:32:08,468",
            "thread_id": "11964",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71a00"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4096",
            "parentcaller": "0x7ff61f0b5b4a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000008",
                "pretty_value": "PAGE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b49e7",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-2"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b49e7",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-fibers-l1-1-2"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b49e7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsGetValue2"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b49e7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b49e7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f021500",
            "parentcaller": "0x7ff61f077156",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f021500",
            "parentcaller": "0x7ff61f077156",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96c20000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f021519",
            "parentcaller": "0x7ff61f077156",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96c20000"
              },
              {
                "name": "FunctionName",
                "value": "ProcessPrng"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96c35010"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f07805c",
            "parentcaller": "0x7ff61f078237",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800000000"
              },
              {
                "name": "RegionSize",
                "value": "0x800000000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f07805c",
            "parentcaller": "0x7ff61f078237",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x5bb175de0000"
              },
              {
                "name": "RegionSize",
                "value": "0x400000000"
              },
              {
                "name": "Protection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0780d8",
            "parentcaller": "0x7ff61f02297f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x5bb175de1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800004000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800008000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4faa",
            "parentcaller": "0x7ff61f0b5b4a",
            "category": "misc",
            "api": "GetCommandLineA",
            "status": true,
            "return": "0x24abf005860",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4fb7",
            "parentcaller": "0x7ff61f0b5b4a",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x24abf003ea6",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800018000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4607",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4607",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b4607",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LCMapStringEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964ed3c0"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b4607",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b4607",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800028000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da80002c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0bb002",
            "parentcaller": "0x7ff61f0a5732",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf026000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800038000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da80003c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800048000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da80004c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da80005c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da80006c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800070000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800080000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da80008c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da800098000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da80009c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f042d71",
            "parentcaller": "0x7ff61f0a5bf2",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f042d81",
            "parentcaller": "0x7ff61f0a5bf2",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "GetSystemTimePreciseAsFileTime"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b75350"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000b4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000b8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4834",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4834",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b4834",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "AreFileApisANSI"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b70f00"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b4834",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b4834",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4839",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-string-l1-1-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4839",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-string-l1-1-0"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b4839",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "CompareStringEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964f7130"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b4839",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b4839",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b4862",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "EnumSystemLocalesEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96557f40"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b4862",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b4862",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b488b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-datetime-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b488b",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-datetime-l1-1-1"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b488b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetDateFormatEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff965455b0"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b488b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b488b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b48b4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetLocaleInfoEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964f0210"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b48b4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b48b4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b48dd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetTimeFormatEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9654d1a0"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b48dd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b48dd",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b4906",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "GetUserDefaultLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9650ae80"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b4906",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b4906",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b492f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "IsValidLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964ead90"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b492f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b492f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4981",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4a67",
            "parentcaller": "0x7ff61f0b4981",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-localization-obsolete-l1-2-0"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b4981",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LCIDToLocaleName"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff964eae60"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b4981",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b4981",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b98",
            "parentcaller": "0x7ff61f0b49aa",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "LocaleNameToLCID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96540070"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b17",
            "parentcaller": "0x7ff61f0b49aa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0b4b48",
            "parentcaller": "0x7ff61f0b49aa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff61f244000"
              },
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f046e14",
            "parentcaller": "0x7ff61f046b29",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f046e24",
            "parentcaller": "0x7ff61f046b29",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetDeviceFamilyInfoEnum"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c8f850"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f046e44",
            "parentcaller": "0x7ff61f046b29",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f046e44",
            "parentcaller": "0x7ff61f046b29",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ValueName",
                "value": "DeviceForm"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f046e44",
            "parentcaller": "0x7ff61f046b29",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f0f68ce",
            "parentcaller": "0x7ff61efdad91",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x24abf003ea6",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074315",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074315",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074315",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-downlevel-shell32-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074315",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff984b0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-downlevel-shell32-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074331",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff984b0000"
              },
              {
                "name": "FunctionName",
                "value": "CommandLineToArgvW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff984ceb30"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074348",
            "parentcaller": "0x7ff61f0f692b",
            "category": "misc",
            "api": "CommandLineToArgvW",
            "status": true,
            "return": "0x24abf025480",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
              },
              {
                "name": "NumArgs",
                "value": "13"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074398",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074398",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074398",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074398",
            "parentcaller": "0x7ff61f0f692b",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f074398",
            "parentcaller": "0x7ff61f0f692b",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b20",
            "parentcaller": "0x7ff61f021bb6",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000b8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b20",
            "parentcaller": "0x7ff61f021bb6",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdade6",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdadf6",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "WerRegisterCustomMetadata"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b8bbf0"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae16",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3540000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae16",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae16",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae16",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              },
              {
                "name": "Milliseconds",
                "value": "4000"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae16",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3550000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae16",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae81",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae81",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              },
              {
                "name": "Milliseconds",
                "value": "4000"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdae81",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdaf7f",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdaf7f",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              },
              {
                "name": "Milliseconds",
                "value": "4000"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61efdaf7f",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b20",
            "parentcaller": "0x7ff61f021bb6",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b20",
            "parentcaller": "0x7ff61f021bb6",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f075da1",
            "parentcaller": "0x7ff61f189e0b",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000208"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f04ab91",
            "parentcaller": "0x7ff61eff6aa9",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f04ab91",
            "parentcaller": "0x7ff61eff6aa9",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96c20000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f04abaa",
            "parentcaller": "0x7ff61eff6aa9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96c20000"
              },
              {
                "name": "FunctionName",
                "value": "ProcessPrng"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96c35010"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f04b5e6",
            "parentcaller": "0x7ff61f07308f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc000003a",
            "pretty_return": "OBJECT_PATH_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f04b5e6",
            "parentcaller": "0x7ff61f07308f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000208"
              },
              {
                "name": "DesiredAccess",
                "value": "0xa0100080",
                "pretty_value": "GENERIC_READ|GENERIC_EXECUTE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f04ba1c",
            "parentcaller": "0x7ff61f04bc6d",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000240"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000208"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:32:08,484",
            "thread_id": "11836",
            "caller": "0x7ff61f04ba51",
            "parentcaller": "0x7ff61f04bc6d",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x40000003",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000240"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac5000000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95f3f0"
              },
              {
                "name": "ViewSize",
                "value": "0x136be000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:32:08,500",
            "thread_id": "11836",
            "caller": "0x7ff61f04be04",
            "parentcaller": "0x7ff61f04c9a4",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:32:08,500",
            "thread_id": "11836",
            "caller": "0x7ff61f04be14",
            "parentcaller": "0x7ff61f04c9a4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "PrefetchVirtualMemory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96556590"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61f04bd36",
            "parentcaller": "0x7ff61f071e1d",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac5000000"
              },
              {
                "name": "RegionSize",
                "value": "0x136be000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61f04698c",
            "parentcaller": "0x7ff61eff4c5a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "FunctionName",
                "value": "GetHandleVerifier"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff61f046850"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61f022b9b",
            "parentcaller": "0x7ff61f02254f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4da8000f8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61eff4cc2",
            "parentcaller": "0x7ff61f04bd52",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "71"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61eff4cc2",
            "parentcaller": "0x7ff61f04bd52",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61eff4cc2",
            "parentcaller": "0x7ff61eff6db8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000208"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge"
              },
              {
                "name": "DllBase",
                "value": "0x24ac5000000"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-2"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-l1-2-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-string-l1-1-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-datetime-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-localization-obsolete-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac5000000"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb3c0",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x24ac5000000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb5f1",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000208"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff61efdb680"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12168"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "identity_helper.exe"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb5f1",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000208",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff61efdb680"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12168"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb620",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "msedge.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x24ac5000000"
              },
              {
                "name": "FunctionName",
                "value": "ChromeMain"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x24ac630a5c0"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580009c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff61efdb680"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000bc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ucrtbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96330000"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ucrtbase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96330000"
              },
              {
                "name": "FunctionName",
                "value": "signal"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff963a18e0"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000d8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800038000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800090000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff983c0000"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff983c0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "EventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92e80"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "EventSetInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92af0"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800100000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800108000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff93cf0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\uxtheme.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "uxtheme.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff93cf0000"
              },
              {
                "name": "FunctionName",
                "value": "ThemeInitApiHook"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff93cfcde0"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0\\xf0?\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000250"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000250"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000270"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000250"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              },
              {
                "name": "ValueName",
                "value": "AppsUseLightTheme"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000250"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000026c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x60580006c100"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12176"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x0000026c",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x60580006c100"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12176"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf037000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800029000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580002d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "identity_helper.exe"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7ff61efc0000"
              },
              {
                "name": "FunctionName",
                "value": "GetHandleVerifier"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7ff61f046850"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000003c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580010c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580011c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x60580006c100"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800124000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac62c9c51",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000204"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "MSCTF.dll"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800204000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x24ac62cef1b",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "Kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00114000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x7fff9653156c",
            "parentcaller": "0x24ac62cef2b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SetThreadDescription"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff965439c0"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x24ac62ceecc",
            "parentcaller": "0x24ac630a10d",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "LoaderLockSampler"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x24ac62ceee8",
            "parentcaller": "0x24ac630a10d",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98010000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580002a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdc000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97fdb000"
              },
              {
                "name": "ModuleName",
                "value": "MSCTF.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "12176",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580002b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:32:08,515",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x02\\x00\\x00\\x00g\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\x00l\\x00e\\x00s\\x00\\x02\\x00\\x00\\x00x\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00i\\x00c\\x00r\\x00o\\x00\\x02\\x00\\x00\\x00f\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00e\\x00\\\\x00A\\x00p\\x00\\x02\\x00\\x00\\x00i\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00n\\x00\\\\x001\\x004\\x00\\x02\\x00\\x00\\x000\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x008\\x003\\x00\\\\x00\\x02\\x00\\x00\\x00u\\x00d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00a\\x00t\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00c*:\\x96\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSCTF"
              },
              {
                "name": "DllBase",
                "value": "0x7fff97f00000"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000027c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat"
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000\\xbe\\x00\\x00\\x00\\x00\\x00\\x00%\\xbe\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msctf"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97f00000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff97f40760"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ad86c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95e5c0"
              },
              {
                "name": "ViewSize",
                "value": "0x00be3000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985a9000"
              },
              {
                "name": "ModuleName",
                "value": "IMM32.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf047000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000028c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000284"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984a8000"
              },
              {
                "name": "ModuleName",
                "value": "GDI32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000028c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3800000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95ec10"
              },
              {
                "name": "ViewSize",
                "value": "0x000b4000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000294"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak"
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000029c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "\\Sessions\\1\\Windows\\Theme928852983"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3570000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000288"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac38c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0b3fee20"
              },
              {
                "name": "ViewSize",
                "value": "0x000e2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000029c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3570000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0b3fee20"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000294"
              },
              {
                "name": "HandleName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\xb0\\x13\\x00\\x00\\x00\\x00\\x00\\xf7\\xa4\\x13\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000298"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac39b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95e370"
              },
              {
                "name": "ViewSize",
                "value": "0x0013b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12168",
            "caller": "0x7ff61efdb737",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002a8"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002a8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\\x1e\\x00\\x00\\x00\\x00\\x00cY\\x1e\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002ac"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3af0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95e370"
              },
              {
                "name": "ViewSize",
                "value": "0x001e6000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580012c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580012d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800138000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580011c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800138000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800148000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580011c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800138000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580014c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800138000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580015c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580014c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800125000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002b0"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b0"
              },
              {
                "name": "HandleName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00`\r\\x00\\x00\\x00\\x00\\x00 U\r\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002b4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3ce0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95e380"
              },
              {
                "name": "ViewSize",
                "value": "0x000d6000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002bc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002b8"
              },
              {
                "name": "HandleName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00P\\x1d\\x02\\x00\\x00\\x00\\x00LA\\x1d\\x02\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000002bc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ad92b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95e480"
              },
              {
                "name": "ViewSize",
                "value": "0x021d5000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800168000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580000a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "RegisterTraceGuidsW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92a10"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "OpenProcessToken"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d6ac0"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002c4"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "GetTokenInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d61d0"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xc7\\x04\\x00X`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "IsValidSid"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d6d80"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "GetLengthSid"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d68c0"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "ConvertSidToStringSidW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d5a70"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetDeviceFamilyInfoEnum"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c8f850"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002c4"
              },
              {
                "name": "ValueName",
                "value": "DeviceForm"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c4"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "USER32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d60000"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97d60000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "USER32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "PostThreadMessageW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d87ee0"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "windows",
            "api": "PostThreadMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              },
              {
                "name": "Message",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "USER32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff97d60000"
              },
              {
                "name": "FunctionName",
                "value": "PeekMessageW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97d6a3e0"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySection"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced9f0"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": false,
            "return": "0xffffffffc0000022",
            "pretty_return": "ACCESS_DENIED",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000910"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000000"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-wow64-l1-1-1.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "IsWow64Process2"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff965470e0"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "RegOpenKeyExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d6180"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              },
              {
                "name": "Handle",
                "value": "0x000001fc"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "RegQueryValueExW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d6160"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              },
              {
                "name": "ValueName",
                "value": "UBR"
              },
              {
                "name": "Data",
                "value": "3803"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              },
              {
                "name": "ValueName",
                "value": "DisplayVersion"
              },
              {
                "name": "Data",
                "value": "22H2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "RegCloseKey"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff983d6930"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001fc"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "IsWow64Process2"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff965470e0"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000910"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3590000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95ec60"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3590000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000910"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00001740"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000910"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000910"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00001740"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3dc0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95eb50"
              },
              {
                "name": "ViewSize",
                "value": "0x00080000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00001740"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": false,
            "return": "0xffffffffc0000022",
            "pretty_return": "ACCESS_DENIED",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000008d8"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000000"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000008d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3590000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95e950"
              },
              {
                "name": "ViewSize",
                "value": "0x00040000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580009d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800059000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580009e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800049000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580009f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580004d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580005a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580017c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580017d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580005b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580017e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580004e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580017f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800180000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000008d8"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800184000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580004a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800194000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800005000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000001fc"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x60580006c310"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12184"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000001fc",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x60580006c310"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12184"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800169000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa1\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00<.\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12184",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf038000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12184",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf039000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "12184",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf106000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001a1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:32:08,531",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001a4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580005d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001aa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001ad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x60580006c310"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac62c9c51",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002a4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "Kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800208000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96531762",
            "parentcaller": "0x24ac52bd9a5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800204000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "38"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x10\\xa3\\x00\\xbfJ\\x02\\x00\\x00r\\x00o\\x00g\\x00r\\x00a\\x00m\\x00 \\x00F\\x00i\\x00l\\x00e\\x00s\\x00 \\x00(\\x00x\\x008\\x006\\x00)\\x00\\\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00E\\x00d\\x00g\\x00e\\x00\\\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\\\x001\\x004\\x008\\x00.\\x000\\x00.\\x003\\x009\\x006\\x007\\x00.\\x008\\x003\\x00\\\\x00r\\x00e\\x00s\\x00o\\x00"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x24ac62ceecc",
            "parentcaller": "0x24ac630a10d",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "PerfettoTrace"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x24ac62ceee8",
            "parentcaller": "0x24ac630a10d",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580004f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "WerRegisterCustomMetadata"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b8bbf0"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              },
              {
                "name": "Milliseconds",
                "value": "4000"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              },
              {
                "name": "Milliseconds",
                "value": "4000"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580016c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580012d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6058001a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800165000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x4ce8fac83000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00002000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00004000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00004000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00008000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00014000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00014000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00008000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00008000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00014000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00014000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00008000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00008000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00024000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00030000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580020c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800208000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800210000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0003c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00004000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00040000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00050000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00054000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002d4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050200"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12188"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002d4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050200"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12188"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf03a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000006000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800212000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00058000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00068000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050200"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac62c9c51",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002dc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0006c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0007c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0008c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff965f8ec6",
            "parentcaller": "0x24ac62b0158",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "38"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xa5\\x03\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12188"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00090000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0009c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96531762",
            "parentcaller": "0x24ac52bd9a5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00090000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff96531762",
            "parentcaller": "0x24ac52bd9a5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0009c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x24ac62ceecc",
            "parentcaller": "0x24ac64f1293",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "HangWatcher"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x24ac62ceee8",
            "parentcaller": "0x24ac64f1293",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac620ee58",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12188",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac620ee58",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002cc"
              },
              {
                "name": "Milliseconds",
                "value": "10000"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00090000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "38"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xa5\\x03\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0009c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "winrt_app_id.CrUtilityMain"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "shell32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97610000"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff97610000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "shell32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002f8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050160"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12192"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002f8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050160"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12192"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf03b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800213000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050160"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac62c9c51",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000308"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580021c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff96531762",
            "parentcaller": "0x24ac52bd9a5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580020c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00025000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0008d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c530fd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abee91000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf048000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff965f8ec6",
            "parentcaller": "0x24ac62b0158",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "38"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x8b\\x04\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12192"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x24ac62ceecc",
            "parentcaller": "0x24ac630a10d",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "ThreadPoolServiceThread"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x24ac62ceee8",
            "parentcaller": "0x24ac630a10d",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12192",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac620eec1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000304"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050140"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12196"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000304",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050140"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12196"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00005000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf03c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf049000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800215000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00069000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050140"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac62c9c51",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000031c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0006d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0007d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff965f8ec6",
            "parentcaller": "0x24ac62b0158",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "38"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\x8a\\x04\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12196"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0009e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x24ac62ceecc",
            "parentcaller": "0x24ac62ced3f",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "ThreadPoolForegroundWorker"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x24ac62ceee8",
            "parentcaller": "0x24ac62ced3f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac6254b81",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12196",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac6254b81",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              },
              {
                "name": "Milliseconds",
                "value": "60185"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000318"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050100"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12200"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000318",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050100"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12200"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf03d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf03e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00059000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800216000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c00050100"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff9653c6f3",
            "parentcaller": "0x7fff9653c5aa",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xa8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12200"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff9653c728",
            "parentcaller": "0x7fff9653c5aa",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "24"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x05\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12200"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff9653c752",
            "parentcaller": "0x7fff9653c5aa",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "22"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x02\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12200"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x24ac5c4c4eb",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xa8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xfc\\xff\\xff\\xff"
              },
              {
                "name": "ThreadId",
                "value": "12200"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac62c9c51",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000032c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0008e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff965f8ec6",
            "parentcaller": "0x24ac62b0158",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "38"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x8c\\x04\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12200"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x24ac62ceecc",
            "parentcaller": "0x24ac62ced3f",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "ThreadPoolBackgroundWorker"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x24ac62ceee8",
            "parentcaller": "0x24ac62ced3f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac6254b81",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12200",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac6254b81",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              },
              {
                "name": "Milliseconds",
                "value": "60184"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000328"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c000500c0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12204"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "msedge.dll"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000328",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c000500c0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12204"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf03f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000c4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000007000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00014000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800218000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x24ac62c9bd0"
              },
              {
                "name": "Parameter",
                "value": "0x605c000500c0"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac62c9c51",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000033c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00009000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00015000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00026000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965f8ec6",
            "parentcaller": "0x24ac62b0158",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "38"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x8e\\x04\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12204"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0009f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x24ac62ceecc",
            "parentcaller": "0x24ac630a10d",
            "category": "threading",
            "api": "SetThreadDescription",
            "status": true,
            "return": "0x10000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadDescription",
                "value": "Chrome_ChildIOThread"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x24ac62ceee8",
            "parentcaller": "0x24ac630a10d",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00006000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000b1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000ad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800219000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000c2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00100000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12184",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0006e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000c3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00051000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000e1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00007000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac6ad9b5f",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00P\\x00\\x00\\x00\\xd1-\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "80"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00105000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00106000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0000b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0006a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac6ad9d2e",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xc8\\x00\\x00\\x00bw\\xc8\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd3S\\xa8\\x8a\\xaa\\xc1d\\xe1\\xd6P\\xc3lzu\\xa6A\\xe3E\\xf0\\xa3\\x8e\\xd3\\x07\\xd5\\xaf\\x91\\xa9{5Mk\\x01\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00x\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x008\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\xa0\\x18\\x8aZ\\xaaO\\xb9}\\x03\\xf2-.\\x02\\x18\n\\x10\\x00\\x00\\x00\\x88\\x01\\x00\\x00?1\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00110000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000d1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac5444292",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000004"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000344"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96506785",
            "parentcaller": "0x24ac54442a3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00107000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff9653c386",
            "parentcaller": "0x7fff9653c25e",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000004"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac35d0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0bafe660"
              },
              {
                "name": "ViewSize",
                "value": "0x00020000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00114000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac5ca0093",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xfe3\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "8000"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00055000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00016000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "8000"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00120000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0007e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0012c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "48"
              }
            ],
            "repeated": 0,
            "id": 795
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x0005\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "88"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96531762",
            "parentcaller": "0x24ac52bd9a5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00108000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96531762",
            "parentcaller": "0x24ac52bd9a5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0010c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96531762",
            "parentcaller": "0x24ac52bd9a5",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00110000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x008\\x01\\x00\\x00q1\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00H\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd7U\\x8dN\\x00\\x00\\x00\\x00L\\x1c!\\x95\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x05\\x00\\x00@\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "376"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000ae000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00F5\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x05\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "88"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x0c8\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0008f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00/6\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "232"
              }
            ],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000e2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x0c8\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xa0\\x01\\x00\\x00j6\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00P\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x87\\x1bV\\x00\\x00\\x00\\x00=\\x8cq\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "416"
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x1a7\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x06\\x00\\x00@\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "232"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xeb7\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00z\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x06\\x00\\x00@\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "232"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\xc7;\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x07\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x93<\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "200"
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\x9e8\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x06\\x00\\x00@\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "232"
              }
            ],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00027000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00108000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\xc7;\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x07\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x93<\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "200"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xb8\\x00\\x00\\x00\\x9f8\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00@\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00B\\x1aQ\\x13\\x01\\x00\\x00\\x00?\\x8cq\\xf0\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "184"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x008\\x00\\x00\\x00\\xac8\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00$\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "56"
              }
            ],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac5444292",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": false,
            "return": "0xffffffffc0000022",
            "pretty_return": "ACCESS_DENIED",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000004"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000000"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x24ac5444292",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": false,
            "return": "0xffffffffc0000022",
            "pretty_return": "ACCESS_DENIED",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000344"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000000"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-05-28 22:32:08,546",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x17A\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00@\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "88"
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-winrt-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96ff0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-winrt-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "RoInitialize"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9709dd80"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00B9\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00@\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "232"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00X\\x00\\x00\\x00\\x17A\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\"\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00@\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "88"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7fff96524f76",
            "parentcaller": "0x7fff9709ee60",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x008\\x01\\x00\\x00\\9\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00H\\x00\\x00\\x008\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xaa\\xb1\\xd4T\\x00\\x00\\x00\\x009\\x8cq\\xf0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x07\\x00\\x00@\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "312"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x008\\x00\\x00\\x00\\x1a:\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00$\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "56"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00VD\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 831
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xf4:\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00xF\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000350"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x1e=\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00j?\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00#\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000354"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000350"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000354"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9421f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94213f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf040000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf04a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00109000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 858
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0005a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 859
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000e3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000b2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": false,
            "return": "0xffffffffc0000022",
            "pretty_return": "ACCESS_DENIED",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000004"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000000"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": false,
            "return": "0xffffffffc0000022",
            "pretty_return": "ACCESS_DENIED",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x00000344"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000000"
              },
              {
                "name": "Options",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000004"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac35f0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95cf00"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000004"
              }
            ],
            "repeated": 0,
            "id": 865
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000344"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3e40000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95cf00"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 867
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00121000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00aV\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00{\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 869
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x006W\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x05\\x00\\x00@\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd8\\x00\\x00\\x007W\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "1224"
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0013c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "7991"
              }
            ],
            "repeated": 0,
            "id": 873
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00GW\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x06\\x00\\x00@\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd8\\x00\\x00\\x00IW\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "1144"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xe8X\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00y\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 877
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "RoGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701c1a0"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00GW\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x06\\x00\\x00@\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xd8\\x00\\x00\\x00IW\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "1144"
              }
            ],
            "repeated": 0,
            "id": 879
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CLSIDFromOle1Class"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9709f760"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x05Y\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xcd\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\xc0\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff0\\xce\\x95\n\\xae\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000364"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\"Y\\xd1\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x17\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 890
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 895
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              }
            ],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000360"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\__ComCatalogCache__"
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000360"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3e50000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95ce50"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 899
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf05b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 900
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\COM3"
              },
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "Com+Enabled"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled"
              }
            ],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "clbcatq.dll"
              }
            ],
            "repeated": 0,
            "id": 905
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000368"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98230000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000a9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982d4000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 909
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a8000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 912
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 913
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a8000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 914
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf107000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 916
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              },
              {
                "name": "EventName",
                "value": "\\KernelObjects\\MaximumCommitCondition"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98230000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff9824d990"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 918
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000374"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime"
              }
            ],
            "repeated": 0,
            "id": 921
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000378"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000374"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ActivatableClassId"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId"
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.ApplicationModel.Background.BackgroundExecutionManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager"
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037c"
              },
              {
                "name": "KeyInformation",
                "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00|\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00E\\x00x\\x00e\\x00c\\x00u\\x00t\\x00i\\x00o\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\x0bY\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\x0bY\\xffff\\x7f\\x00\\x00\\xffd8\\xffca\\xff95\n\\xffae\\x00\\x00\\x00\\xffe3\\xffa4\\xffe8$\\x7f\\xffde\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xff8a\\x04\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe4F\\xffd5J\\x02\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00 w\\x04\\xffbfJ\\x02\\x00\\x00 \\xffcb\\xff95\n\\xffae\\x00\\x00\\x00\\xffe4I\\xfff3R\\xffff\\x7f\\x00\\x00\\xffd0\\xffe4F\\xffd5J\\x02\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xfffft\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\x0bY\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0\\x15S\\xffff\\x7f\\x00\\x00\\xffb8\\xffcf\\x15S\\xffff\\x7f\\x00\\x00 w\\x04\\xffbfJ\\x02\\x00\\x00\\xfff8\\xff81\\x15S\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00J\\x02\\x00\\x00h\\xffd0\\x15S\\xffff\\x7f\\x00\\x00t\\x03\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0\\x15S\\xffff\\x7f\\x00\\x00\\x10\\xffcb\\xff95\n\\xffae\\x00\\x00\\x00\\xff98\\xff85\\x15S\\xffff\\x7f\\x00\\x00 \\xffcb\\xff95\n\\xffae\\x00\\x00\\x000\\x12\\x03\\xffbfJ\\x02\\x00\\x00\\xffb0t\\x04\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffa0\\xffcc\\xff95\n\\xffae\\x00\\x00\\x00 w\\x04\\xffbfJ\\x02\\x00\\x00@\\xff8a\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00L\\x12\\x03\\xffbfJ\\x02\\x00\\x000\\x00\\x00\\x00J\\x02\\x00\\x00t\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffcb\\xff95\n\\xffae\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10w\\x04\\xffbfJ\\x02\\x00\\x00\\x19h\\x04\\xff97\\xffff\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 924
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 926
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\execmodelclient.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037c"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 935
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              }
            ],
            "repeated": 0,
            "id": 937
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 938
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xcb\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00J\\x02\\x00\\x00\\xc1\\xcd\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Uab\\x88\\x18'\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00L\\xae#\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 939
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000037c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000037c"
              },
              {
                "name": "SubKey",
                "value": "Software\\Classes"
              },
              {
                "name": "Handle",
                "value": "0x00000380"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegNotifyChangeKeyValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\"
              },
              {
                "name": "NotifyFilter",
                "value": "0x10000005"
              },
              {
                "name": "WatchSubtree",
                "value": "1"
              },
              {
                "name": "Asynchronous",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 943
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000384"
              }
            ],
            "repeated": 0,
            "id": 944
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xce\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\xff\\xff\\xff\\xf8\\x81\\x15S\\xff\\x7f\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S\\xff\\x7f\\x00\\x00\\x88\\xcf\\x95\n\\xae\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\x02T\\x96\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              }
            ],
            "repeated": 0,
            "id": 946
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x00000384"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              },
              {
                "name": "ValueName",
                "value": "MaxSxSHashCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount"
              }
            ],
            "repeated": 0,
            "id": 948
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000384"
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 950
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\PROPSYS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91eb0000"
              }
            ],
            "repeated": 0,
            "id": 951
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CoreMessaging"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93840000"
              }
            ],
            "repeated": 0,
            "id": 952
          },
          {
            "timestamp": "2026-05-28 22:32:08,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\execmodelclient"
              },
              {
                "name": "DllBase",
                "value": "0x7fff84d00000"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\execmodelclient.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d00000"
              }
            ],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff84d00000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\execmodelclient.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff84d00000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff84d0ac80"
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff84d00000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff84d0b9b0"
              }
            ],
            "repeated": 0,
            "id": 957
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff84d00000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff84d0bb00"
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 959
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 961
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf04c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\xb9\\x04\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x80\\xba\\x04\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xba\\x04\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xb4\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xd0\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xbb\\x04\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xf8\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbc\\x04\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xd0\\xba\\x04\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00V\\xbb\\x04\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\\\xbb\\x04\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xe0\\xb9\\x04\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x80\\xba\\x04\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xba\\x04\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xb4\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc8\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xd0\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xbb\\x04\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xf8\\xbb\\x04\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xbc\\x04\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xd0\\xba\\x04\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00V\\xbb\\x04\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\\\xbb\\x04\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000003c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00001000",
                "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000003c0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 970
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa1\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00<.\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000003c8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x24abf107560"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "shcore.dll"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000003c8",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x24abf107560"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000004"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000003c8"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x60580021b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 979
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff984c53d0"
              },
              {
                "name": "Parameter",
                "value": "0x24abf107560"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98557000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 982
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98557000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984f84de",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 984
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Foundation.Diagnostics.AsyncCausalityTracer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer"
              }
            ],
            "repeated": 0,
            "id": 986
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00f\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00D\\x00i\\x00a\\x00g\\x00n\\x00o\\x00s\\x00t\\x00i\\x00c\\x00s\\x00.\\x00A\\x00s\\x00y\\x00n\\x00c\\x00C\\x00a\\x00u\\x00s\\x00a\\x00l\\x00i\\x00t\\x00y\\x00T\\x00r\\x00a\\x00c\\x00e\\x00r\\x00\\x00\\x00\\x10\\xffc6\\xff95\n\\xffae\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xffe8\\xffb2\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc6\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff99\\x04\\xffbfJ\\x02\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffc6\\xff95\n\\xffae\\x00\\x00\\x00?U%\\xffa9\\xffcf\\xff86\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90t\\x04\\xffbfJ\\x02\\x00\\x00\\xffe8\\xffb2\\x04\\xffbfJ\\x02\\x00\\x00\\xffc0\\xffb2\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xff99\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffb2\\x04\\xffbfJ\\x02\\x00\\x00\\xffd0\\xff99\\x04\\xffbfJ\\x02\\x00\\x00\\xff90t\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90t\\x04\\xffbfJ\\x02\\x00\\x00\\xffc0\\xffc7\\x05\\xffbfJ\\x02\\x00\\x00\\xffc0\\xffc7\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff99\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffc7\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xff99\\x04\\xffbfJ\\x02\\x00\\x00\\xffb0\\x1e\\x03\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc7\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffc9\\x05\\xffbfJ\\x02\\x00\\x00\\xffc0\\xffb2\\x04\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff84d39613",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff84d396fd",
            "parentcaller": "0x7fff84d3962b",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xf5\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xae\\x00\\x00\\x00\\x80\\xc6\\x05\\xbfJ\\x02\\x00\\x00k\\x02T\\x96\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 989
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff84d39675",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 991
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server"
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\combase.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading"
              }
            ],
            "repeated": 0,
            "id": 994
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 995
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003c4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 996
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 997
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1001
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\combase.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96ff0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\combase.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970a58a0"
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970cf090"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ole32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff985b0000"
              }
            ],
            "repeated": 0,
            "id": 1010
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff985b0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ole32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff985b0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateFreeThreadedMarshaler"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970687a0"
              }
            ],
            "repeated": 0,
            "id": 1012
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.UI.Notifications.ToastNotificationManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager"
              }
            ],
            "repeated": 0,
            "id": 1013
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "KeyInformation",
                "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00T\\x00o\\x00a\\x00s\\x00t\\x00N\\x00o\\x00t\\x00i\\x00f\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffd1\\xff95\n\\xffae\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xffd8\\xffd1\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffd2\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9e\\x04\\xffbfJ\\x02\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffd1\\xff95\n\\xffae\\x00\\x00\\x00_A%\\xffa9\\xffcf\\xff86\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0s\\x04\\xffbfJ\\x02\\x00\\x00\\xffd8\\xffd1\\x04\\xffbfJ\\x02\\x00\\x00\\xffb0\\xffd1\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00P\\xff9e\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffd1\\x04\\xffbfJ\\x02\\x00\\x00P\\xff9e\\x04\\xffbfJ\\x02\\x00\\x00\\xffd0s\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0s\\x04\\xffbfJ\\x02\\x00\\x00 \\xffc5\\x05\\xffbfJ\\x02\\x00\\x00 \\xffc5\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff9e\\x04\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffc5\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xff9e\\x04\\xffbfJ\\x02\\x00\\x00\\xffd0\\x1c\\x03\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffd3\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffcd\\x05\\xffbfJ\\x02\\x00\\x00\\xffb0\\xffd1\\x04\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1014
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 1015
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\wpnapps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 1018
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003c4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 1020
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 1021
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x000000ea",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Type",
                "value": "0xae00000003"
              },
              {
                "name": "DataLength",
                "value": "316"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1026
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff84d2d259",
            "parentcaller": "0x7fff84d28bdd",
            "category": "com",
            "api": "CoGetClassObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "38142214-ED63-4965-9214-1BBC06E130E9"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "8E1BBBB9-B3D5-430D-B276-D0E7454CAAB2"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wintypes"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92180000"
              }
            ],
            "repeated": 0,
            "id": 1030
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\RMCLIENT"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94110000"
              }
            ],
            "repeated": 0,
            "id": 1031
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91e70000"
              }
            ],
            "repeated": 0,
            "id": 1032
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\twinapi.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90da0000"
              }
            ],
            "repeated": 0,
            "id": 1033
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wpnapps"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82770000"
              }
            ],
            "repeated": 0,
            "id": 1034
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wpnapps.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82770000"
              }
            ],
            "repeated": 0,
            "id": 1035
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82770000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\wpnapps.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 1036
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82770000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82787a60"
              }
            ],
            "repeated": 0,
            "id": 1037
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82770000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82787d00"
              }
            ],
            "repeated": 0,
            "id": 1038
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82770000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8278b840"
              }
            ],
            "repeated": 0,
            "id": 1039
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1040
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1041
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "12232",
            "caller": "0x7fff84d0907d",
            "parentcaller": "0x7fff84d2d2af",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "D648FEA1-EA00-4FF4-B8BD-034BD2B25A23"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "1D868537-EEA2-4C03-BB99-8A58862F7A59"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1042
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 1044
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 1046
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 1047
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 1048
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 1049
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 1051
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 1053
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 1058
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 1059
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 1060
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf051000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1061
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf052000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1062
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 1063
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 1064
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 1065
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "AppID\\identity_helper.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\identity_helper.exe"
              }
            ],
            "repeated": 1,
            "id": 1066
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 1067
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "RaiseDefaultAuthnLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel"
              }
            ],
            "repeated": 0,
            "id": 1068
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 1069
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 1070
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              },
              {
                "name": "ValueName",
                "value": "DefaultAccessPermission"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission"
              }
            ],
            "repeated": 0,
            "id": 1071
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 0,
            "id": 1072
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1073
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xbd\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1074
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 0,
            "id": 1075
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1076
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 1077
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1078
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1079
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1080
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 0,
            "id": 1081
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1082
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1083
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1084
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00002e38"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.COM.DISABLE.11832"
              }
            ],
            "repeated": 0,
            "id": 1085
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.IEC.STATUS.6c736db0"
              }
            ],
            "repeated": 0,
            "id": 1086
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf055000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1087
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{00000134-0000-0000-C000-000000000046}"
              },
              {
                "name": "Handle",
                "value": "0x0000040e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 1088
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000040e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000416"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1089
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000416"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1090
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000416"
              }
            ],
            "repeated": 0,
            "id": 1091
          },
          {
            "timestamp": "2026-05-28 22:32:08,578",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040e"
              }
            ],
            "repeated": 0,
            "id": 1092
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff964fcc1f",
            "parentcaller": "0x7fff98b6b8ed",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000418"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf0655d0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12256"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 1093
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12256",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf056000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1094
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12256",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf057000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1095
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf058000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1096
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12256",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800220000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1097
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf059000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1098
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf078000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1099
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf079000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1100
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf07a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1101
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf07b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1102
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c677c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000003c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 1103
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12256",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1104
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12256",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf0655d0"
              }
            ],
            "repeated": 0,
            "id": 1105
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12256",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf069000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1106
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf07c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1107
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf108000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1108
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800222000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1109
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1110
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf002340"
              }
            ],
            "repeated": 0,
            "id": 1111
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000414"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1112
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf06a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1113
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf06b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1114
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf06c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1115
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf08d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1116
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf08e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1117
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1118
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf08f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1119
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf091000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1120
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf06e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1121
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 1122
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1123
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1124
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 1125
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1126
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x19\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1127
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@H\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00o\\x00n\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00L\\x00E\\x005\\x008\\x008\\x00E\\x00F\\x006\\x005\\x000\\x00B\\x00A\\x00C\\x00F\\x006\\x006\\x00A\\x009\\x006\\x004\\x004\\x005\\x002\\x00F\\x00D\\x00D\\x003\\x007\\x00"
              }
            ],
            "repeated": 0,
            "id": 1128
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1129
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8s\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1130
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1131
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98H\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1132
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xd3\\x80\\xa2%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x10\\xe9\\xdf\\x0b\\xae\\x00\\x00\\x00\\x08\\xe9\\xdf\\x0b\\xae\\x00\\x00\\x00\\xd8\\xe8\\xdf\\x0b\\xae\\x00\\x00\\x00\\xf8\\xe8\\xdf\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1133
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90H\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xe6\\xdf\\x0b\\xae\\x00\\x00\\x00<\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1134
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1135
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "h\\x19\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1136
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`I\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1137
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1138
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "hr\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1139
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1140
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "xJ\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1141
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xb3\\xbc\\xa2%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00p\\xe5\\xdf\\x0b\\xae\\x00\\x00\\x00h\\xe5\\xdf\\x0b\\xae\\x00\\x00\\x008\\xe5\\xdf\\x0b\\xae\\x00\\x00\\x00X\\xe5\\xdf\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1142
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pJ\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xe3\\xdf\\x0b\\xae\\x00\\x00\\x00<\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1143
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1144
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12260",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000043c"
              }
            ],
            "repeated": 0,
            "id": 1145
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1146
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x7fff5262bafb",
            "parentcaller": "0x7fff5262b4af",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x6f0000104000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1147
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1148
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 1149
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800223000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1150
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0005b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1151
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12264",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf002340"
              }
            ],
            "repeated": 0,
            "id": 1152
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff970c41cf",
            "parentcaller": "0x7fff98c938c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1153
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1154
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000434"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf065550"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12268"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 1155
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000434",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf065550"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12268"
              },
              {
                "name": "ProcessId",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 1156
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1157
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf098000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1158
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1159
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf114000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1160
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800225000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1161
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0006b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1162
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1163
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf065550"
              }
            ],
            "repeated": 0,
            "id": 1164
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000450"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 1165
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1166
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 1,
            "id": 1167
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003b2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}"
              }
            ],
            "repeated": 0,
            "id": 1168
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}"
              }
            ],
            "repeated": 0,
            "id": 1169
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1170
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1171
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1172
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1173
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff874d0000"
              }
            ],
            "repeated": 0,
            "id": 1174
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1175
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1176
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1177
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1178
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{00000035-0000-0000-C000-000000000046}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 1179
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1180
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1181
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1182
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1183
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}"
              }
            ],
            "repeated": 0,
            "id": 1184
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1185
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1186
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1187
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1188
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1189
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1190
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1191
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1192
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x14\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00i\\x00e\\x00t\\x00H\\x00o\\x00u\\x00r\\x00s\\x00P\\x00r\\x00o\\x00f\\x00i\\x00l\\x00e\\x00.\\x00A\\x00l\\x00a\\x00r\\x00m\\x00s\\x00O\\x00n\\x00l\\x00y\\x00"
              }
            ],
            "repeated": 0,
            "id": 1193
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@H\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00o\\x00n\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00L\\x00E\\x005\\x008\\x008\\x00E\\x00F\\x006\\x005\\x000\\x00B\\x00A\\x00C\\x00F\\x006\\x006\\x00A\\x009\\x006\\x004\\x004\\x005\\x002\\x00F\\x00D\\x00D\\x003\\x007\\x00"
              }
            ],
            "repeated": 0,
            "id": 1194
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1195
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "8r\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1196
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1197
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "XI\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1198
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xd3\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x10\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\xd8\\xcf\\xff\\x0b\\xae\\x00\\x00\\x00\\xf8\\xcf\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1199
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00PI\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xcd\\xff\\x0b\\xae\\x00\\x00\\x00X\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1200
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1201
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08\\x15\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00e\\x00r\\x00s\\x00o\\x00n\\x00a\\x00t\\x00i\\x00o\\x00n\\x00 \\x00D\\x00y\\x00n\\x00a\\x00m\\x00i\\x00c\\x00 \\x00F\\x00a\\x00l\\x00s\\x00e\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1202
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0H\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1203
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1204
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "Xp\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1205
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1206
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X@\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1207
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xb3\\xa3\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00p\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x008\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00X\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1208
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P@\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xca\\xff\\x0b\\xae\\x00\\x00\\x00X\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1209
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1210
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1211
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1212
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff90dfc45c",
            "parentcaller": "0x7fff84d090c9",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "6B3B8D23-FA8D-40B9-8DBD-B950333E2C52"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1213
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1214
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1215
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1216
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "h\\x19\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1217
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`I\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1218
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1219
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8u\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1220
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1221
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98H\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1222
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf099000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1223
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90H\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xcd\\xff\\x0b\\xae\\x00\\x00\\x00T\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1224
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf09a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1225
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x14\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00i\\x00e\\x00t\\x00H\\x00o\\x00u\\x00r\\x00s\\x00P\\x00r\\x00o\\x00f\\x00i\\x00l\\x00e\\x00.\\x00A\\x00l\\x00a\\x00r\\x00m\\x00s\\x00O\\x00n\\x00l\\x00y\\x00"
              }
            ],
            "repeated": 0,
            "id": 1226
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1227
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`@\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00c\\x00:\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00D\\x004\\x007\\x00F\\x004\\x005\\x00C\\x000\\x009\\x00F\\x00E\\x00A\\x00E\\x00D\\x00A\\x008\\x00D\\x008\\x008\\x00A\\x006\\x000\\x00E\\x006\\x005\\x001\\x00]\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1228
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1229
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1230
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "xt\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1231
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1232
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18M\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1233
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xb3\\xa3\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00p\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x008\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00X\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1234
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10M\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xca\\xff\\x0b\\xae\\x00\\x00\\x00T\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1235
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1236
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1237
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1238
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf09c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1239
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1240
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1241
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1242
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1243
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}"
              }
            ],
            "repeated": 0,
            "id": 1244
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1245
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1246
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              }
            ],
            "repeated": 0,
            "id": 1247
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1248
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              }
            ],
            "repeated": 0,
            "id": 1249
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1250
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1251
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1252
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xcb\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xb0\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1253
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1254
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1255
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1256
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1257
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1258
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xcb\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xa0\\xcc\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1259
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1260
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1261
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1262
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1263
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Windows Push Notification Developer Proxy Stub"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1264
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1265
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1266
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "ExecModelProxy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1267
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1268
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1269
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1270
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96524aa9",
            "parentcaller": "0x7fff965031c6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\System32\\wpnapps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1271
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1272
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\System32\\wpnapps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1273
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96524aa9",
            "parentcaller": "0x7fff965031c6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\execmodelproxy.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1274
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1275
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              }
            ],
            "repeated": 0,
            "id": 1276
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1277
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\execmodelproxy.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1278
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1279
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xca\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xcb\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1280
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1281
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1282
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1283
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              }
            ],
            "repeated": 0,
            "id": 1284
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1285
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1286
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1287
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xca\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xcb\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1288
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xca\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x000\\xcb\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1289
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1290
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1291
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1292
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1293
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1294
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xca\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x000\\xcb\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1295
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1296
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1297
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1298
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1299
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1300
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1301
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              }
            ],
            "repeated": 0,
            "id": 1302
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1303
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1304
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc8\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00p\\xc9\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1305
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1306
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1307
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}"
              }
            ],
            "repeated": 0,
            "id": 1308
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1309
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1310
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1311
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1312
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1313
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1314
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1315
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1316
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "ExecModelProxy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1317
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1318
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1319
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1320
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1321
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1322
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1323
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xc7\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\xc8\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1324
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1325
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\execmodelproxy.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1326
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1327
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1328
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xc7\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\xc8\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1329
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1330
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%systemroot%\\system32\\execmodelproxy.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1331
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1332
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 1333
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1334
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1335
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xc6\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xf0\\xc7\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1336
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 1337
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1338
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1339
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1340
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1341
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xc6\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xc7\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1342
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1343
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xc6\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xf0\\xc7\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1344
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1345
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1346
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1347
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1348
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              },
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              }
            ],
            "repeated": 0,
            "id": 1349
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 1350
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              }
            ],
            "repeated": 0,
            "id": 1351
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1352
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1353
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xc6\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x000\\xc7\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1354
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1355
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}"
              }
            ],
            "repeated": 0,
            "id": 1356
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}"
              },
              {
                "name": "Handle",
                "value": "0x00000442"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}"
              }
            ],
            "repeated": 0,
            "id": 1357
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1358
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1359
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9702ad4d",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000442"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 1360
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000442"
              }
            ],
            "repeated": 0,
            "id": 1361
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1362
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1363
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1364
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1365
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1366
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88\\x12\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00w\\x00p\\x00n\\x00a\\x00p\\x00p\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1367
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0L\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00m\\x00r\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00e\\x00x\\x00e\\x00c\\x00m\\x00o\\x00d\\x00e\\x00l\\x00p\\x00r\\x00o\\x00x\\x00y\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1368
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1369
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8u\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1370
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1371
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98N\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1372
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc3\\xb1\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x00\\xda\\xff\\x0b\\xae\\x00\\x00\\x00\\xf8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xc8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xe8\\xd9\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1373
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90N\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd7\\xff\\x0b\\xae\\x00\\x00\\x00`\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1374
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1375
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\x10\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1376
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " M\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1377
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1378
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "xM\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1379
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1380
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pM\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xd4\\xff\\x0b\\xae\\x00\\x00\\x00`\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1381
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1382
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1383
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\execmodelproxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff833f0000"
              }
            ],
            "repeated": 0,
            "id": 1384
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf09d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1385
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1386
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1387
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1388
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{7AB93C52-0E48-4750-BA9D-1A4113981847}"
              },
              {
                "name": "Handle",
                "value": "0x00000462"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7AB93C52-0E48-4750-BA9D-1A4113981847}"
              }
            ],
            "repeated": 0,
            "id": 1389
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000462"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1390
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1391
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1392
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000462"
              }
            ],
            "repeated": 0,
            "id": 1393
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1394
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1395
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1396
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1397
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1398
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\execmodelproxy.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff833f0000"
              }
            ],
            "repeated": 0,
            "id": 1399
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff833f0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\execmodelproxy.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 1400
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1401
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "execmodelproxy.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff833f0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff833f1910"
              }
            ],
            "repeated": 0,
            "id": 1402
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "execmodelproxy.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff833f0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1403
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 1404
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "execmodelproxy.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff833f0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff833f1950"
              }
            ],
            "repeated": 0,
            "id": 1405
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 1,
            "id": 1406
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1407
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965008ee",
            "parentcaller": "0x7fff84d16dcd",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00001000",
                "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 1408
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff84d16eeb",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1409
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{5CADDC63-01D3-4C97-986F-0533483FEE14}"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CADDC63-01D3-4C97-986F-0533483FEE14}"
              }
            ],
            "repeated": 0,
            "id": 1410
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff84d09ae9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1411
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff84d09af9",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1412
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff965008ee",
            "parentcaller": "0x7fff84d096c2",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00001000",
                "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 1413
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff9650cbb0",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1414
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9650aa1f",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1415
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf07d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1416
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff9650aaa8",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xb0\\xc3\\x07\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00P\\xc4\\x07\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xc4\\x07\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x84\\xc5\\x07\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x98\\xc5\\x07\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xa0\\xc5\\x07\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xc5\\x07\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xc8\\xc5\\x07\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\xc5\\x07\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xa0\\xc4\\x07\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00&\\xc5\\x07\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00,\\xc5\\x07\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1417
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9650cbbe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1418
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1419
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1420
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              }
            ],
            "repeated": 0,
            "id": 1421
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965043a6",
            "parentcaller": "0x7fff9709fae4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1422
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1423
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1424
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1425
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1426
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1427
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1428
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x1e\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1429
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf3\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1430
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1431
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "(s\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1432
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1433
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "8\\xf8\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1434
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x83\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xd0\\xff\\x0b\\xae\\x00\\x00\\x008\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd0\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1435
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xf8\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xce\\xff\\x0b\\xae\\x00\\x00\\x00d\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1436
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1437
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\x1d\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1438
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1439
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "8r\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1440
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1441
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xf8\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1442
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00c\\xa4\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x98\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x88\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1443
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xf8\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xca\\xff\\x0b\\xae\\x00\\x00\\x00d\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1444
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1445
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1446
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1447
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1448
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1449
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}"
              },
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}"
              }
            ],
            "repeated": 0,
            "id": 1450
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000466"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1451
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1452
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1453
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              }
            ],
            "repeated": 0,
            "id": 1454
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1455
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1456
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1457
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xf8\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1458
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1459
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "xq\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1460
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1461
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff84d2d2e7",
            "parentcaller": "0x7fff84d28bdd",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "53067330-01CE-4027-947F-FF8580E92463"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "D54E68C2-54CD-48B3-AD9A-3F4A4503BA80"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1462
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xf1\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1463
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc3\\xb1\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x00\\xda\\xff\\x0b\\xae\\x00\\x00\\x00\\xf8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xc8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xe8\\xd9\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1464
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf1\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd7\\xff\\x0b\\xae\\x00\\x00\\x00X\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1465
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1466
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\x1f\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1467
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xf5\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x002\\x001\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x008\\x006\\x000\\x004\\x000\\x00-\\x003\\x002\\x001\\x000\\x002\\x007\\x009\\x004\\x006\\x003\\x00-\\x008\\x004\\x007\\x009\\x007\\x007\\x006\\x000\\x008\\x00-\\x001\\x00"
              }
            ],
            "repeated": 0,
            "id": 1468
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1469
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8u\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1470
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1471
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xf5\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1472
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1473
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf5\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xd4\\xff\\x0b\\xae\\x00\\x00\\x00X\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1474
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 1475
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1476
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1477
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1478
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "WindowsCreateString"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970381a0"
              }
            ],
            "repeated": 0,
            "id": 1479
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf09e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1480
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1481
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1482
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1483
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1484
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff965008ee",
            "parentcaller": "0x7fff970b8bd7",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000460"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00001000",
                "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 1485
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1486
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98d0e53f",
            "parentcaller": "0x7fff98c6faf7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1487
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1488
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "policymanager.dll"
              }
            ],
            "repeated": 0,
            "id": 1489
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\policymanager.dll"
              }
            ],
            "repeated": 0,
            "id": 1490
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1491
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1492
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12268",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c6fad7",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000003c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 1493
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98cafa80",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\policymanager.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1494
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98cafcfe",
            "parentcaller": "0x7fff98cafa80",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000444"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\policymanager.dll"
              }
            ],
            "repeated": 0,
            "id": 1495
          },
          {
            "timestamp": "2026-05-28 22:32:08,593",
            "thread_id": "12232",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000444"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90020000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000a1000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1496
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c5fee4",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1497
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffb5",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1498
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1499
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1500
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1501
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c65082",
            "parentcaller": "0x7fff98c679d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1502
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "msvcp110_win.dll"
              }
            ],
            "repeated": 0,
            "id": 1503
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98cafd68",
            "parentcaller": "0x7fff98cafa80",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000444"
              }
            ],
            "repeated": 0,
            "id": 1504
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98cafa80",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1505
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msvcp110_win.dll"
              }
            ],
            "repeated": 0,
            "id": 1506
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msvcp110_win.dll"
              }
            ],
            "repeated": 0,
            "id": 1507
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msvcp110_win.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1508
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98cafcfe",
            "parentcaller": "0x7fff98caf7b0",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000444"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000440"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msvcp110_win.dll"
              }
            ],
            "repeated": 0,
            "id": 1509
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000444"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff953c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0008a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1510
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffb5",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1511
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1512
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1513
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1514
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c65082",
            "parentcaller": "0x7fff98c679d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1515
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98cafd68",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000444"
              }
            ],
            "repeated": 0,
            "id": 1516
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 1517
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1518
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97fe1",
            "parentcaller": "0x7fff98c97bdd",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x12\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\\\x00S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00m\\x003\\x002\\x00\\\\x00\\x02\\x00\\x00\\x00v\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00_\\x00w\\x00i\\x00n\\x00\\x02\\x00\\x00\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00l\\x00i\\x00c\\x00\\x02\\x00\\x00\\x00i\\x00o\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00v\\x00c\\x00p\\x001\\x00\\x02\\x00\\x00\\x00_\\x00w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00l\\x00l\\x00\\x00\\x00s\\x00\\x02\\x00\\x00\\x00L\\x00S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x003\\x000\\x006\\x00\\x02\\x00\\x00\\x003\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00E\\x00-\\x004\\x000\\x00\\x02\\x00\\x00\\x00-\\x009\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00F\\x00F\\x008\\x005\\x00\\x02\\x00\\x00\\x00E\\x009\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x00\\\\x00P\\x00r\\x00\\x02\\x00\\x00\\x00I\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1519
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1520
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 1521
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 1522
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf115000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1523
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf109000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1524
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp110_win"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff953c0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff95405870"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1525
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\policymanager"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90020000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff90029ed0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 1526
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1527
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1528
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "usermgrcli.dll"
              }
            ],
            "repeated": 0,
            "id": 1529
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\usermgrcli.dll"
              }
            ],
            "repeated": 0,
            "id": 1530
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1531
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900271e2",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps"
              }
            ],
            "repeated": 0,
            "id": 1532
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 1533
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98cafa80",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\usermgrcli.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1534
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1535
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground_UserInControlOfTheseApps"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1536
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027647",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 1537
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002776a",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "Data",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 1538
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98cafcfe",
            "parentcaller": "0x7fff98cafa80",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000468"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\usermgrcli.dll"
              }
            ],
            "repeated": 0,
            "id": 1539
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9002db1b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value"
              }
            ],
            "repeated": 0,
            "id": 1540
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027ca8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value"
              }
            ],
            "repeated": 0,
            "id": 1541
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1542
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c5fee4",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff916c3000"
              },
              {
                "name": "ModuleName",
                "value": "usermgrcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1543
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90025c61",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 1544
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff916bc000"
              },
              {
                "name": "ModuleName",
                "value": "usermgrcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1545
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90025d7c",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 1546
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff916bc000"
              },
              {
                "name": "ModuleName",
                "value": "usermgrcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1547
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps"
              }
            ],
            "repeated": 0,
            "id": 1548
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98cafd68",
            "parentcaller": "0x7fff98cafa80",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 1549
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 1550
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98cafa80",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 1551
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900272a8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "139296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 1552
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff916bb000"
              },
              {
                "name": "ModuleName",
                "value": "usermgrcli.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1553
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\usermgrcli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff916b0000"
              }
            ],
            "repeated": 0,
            "id": 1554
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002732c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 1555
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002739f",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 1556
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027402",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 1557
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002755e",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1558
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground_ForceAllowTheseApps"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1559
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027647",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 1560
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002776a",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "Data",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 1561
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900277f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyismultisz"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz"
              }
            ],
            "repeated": 0,
            "id": 1562
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027836",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicymultiszSeparatorChar"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar"
              }
            ],
            "repeated": 0,
            "id": 1563
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900278f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 1564
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900279b1",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 1565
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027a6c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 1566
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9002db1b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value"
              }
            ],
            "repeated": 0,
            "id": 1567
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1568
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027ca8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value"
              }
            ],
            "repeated": 0,
            "id": 1569
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1570
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90025c61",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 1571
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90025d7c",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 1572
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900271e2",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps"
              }
            ],
            "repeated": 0,
            "id": 1573
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 1574
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1575
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900272a8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "139296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 1576
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002732c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 1577
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002739f",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 1578
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027402",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 1579
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002755e",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1580
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground_ForceDenyTheseApps"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1581
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}"
              },
              {
                "name": "Handle",
                "value": "0x00000472"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}"
              }
            ],
            "repeated": 0,
            "id": 1582
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1583
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1584
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xc3\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x10\\xc4\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1585
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1586
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1587
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027836",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicymultiszSeparatorChar"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar"
              }
            ],
            "repeated": 0,
            "id": 1588
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1589
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900278f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 1590
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900279b1",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 1591
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027a6c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 1592
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000472"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1593
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1594
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96503a9c",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1595
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1596
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 1597
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90025d7c",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 1598
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000472"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1599
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1600
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1601
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1602
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 1603
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000472"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1604
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "139296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 1605
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1606
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000472"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1607
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xc1\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00r\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xa0\\xc2\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1608
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002732c",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 1609
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1610
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 1611
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027402",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 1612
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1613
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1614
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9002755e",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1615
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1616
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 1617
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers"
              }
            ],
            "repeated": 0,
            "id": 1618
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502fe4",
            "parentcaller": "0x7fff9709f195",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "WaitForRestore"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore"
              }
            ],
            "repeated": 0,
            "id": 1619
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96503018",
            "parentcaller": "0x7fff9709f195",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 1620
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96503a9c",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 1621
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1622
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\OLE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 1623
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027836",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "grouppolicymultiszSeparatorChar"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar"
              }
            ],
            "repeated": 0,
            "id": 1624
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1625
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900279b1",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 1626
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027a6c",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 1627
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf080000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1628
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9002db1b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value"
              }
            ],
            "repeated": 0,
            "id": 1629
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90027b73",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value"
              }
            ],
            "repeated": 0,
            "id": 1630
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1631
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90026e85",
            "parentcaller": "0x7fff90026097",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 1632
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff90026d68",
            "parentcaller": "0x7fff90026097",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 1633
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.User"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User"
              }
            ],
            "repeated": 0,
            "id": 1634
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "KeyInformation",
                "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00J\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe9\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffca\\x05\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x0fv\\x0f\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10]\\x06\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffca\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffca\\x05\\xffbfJ\\x02\\x00\\x00\\x10]\\x06\\xffbfJ\\x02\\x00\\x00\\xffe0\\x1b\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10]\\x06\\xffbfJ\\x02\\x00\\x00P\\xffce\\x05\\xffbfJ\\x02\\x00\\x00P\\xffce\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffca\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffce\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffca\\x05\\xffbfJ\\x02\\x00\\x00\\xffe0\\x1b\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffea\\xffbf\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc0\\x05\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd7\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1635
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 1636
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server"
              }
            ],
            "repeated": 0,
            "id": 1637
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 1638
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading"
              }
            ],
            "repeated": 0,
            "id": 1639
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 1640
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000046c"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 1641
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 1642
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 1643
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 1644
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 1645
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1646
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1647
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970474a2",
            "parentcaller": "0x7fff970467e6",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000478"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000374"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Server"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server"
              }
            ],
            "repeated": 0,
            "id": 1648
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000478"
              },
              {
                "name": "ObjectAttributesName",
                "value": "StateRepository"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository"
              }
            ],
            "repeated": 0,
            "id": 1649
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00\\x00\\x0049\\xffa0\\xffc0J\\x02\\x00\\x00\\xff90\\xffc7 S\\xffff\\x7f\\x00\\x00\\xffa2t\\x04\\xff97\\xffff\\x7f\\x00\\x00\\xffd9L\\xfff1R\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff83\\xff81\\xffc2%\\x7f\\xffde\\x00\\x00\\xfff8\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\xff87\\x00\\x0bY\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\x0bY\\xffff\\x7f\\x00\\x00h\\xffe5\\xffbf\\x0b\\xffae\\x00\\x00\\x00s\\xffbf\\xffc2%\\x7f\\xffde\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffec]\\x06\\xffbfJ\\x02\\x00\\x00\\xff88M\\x03\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00 [\\x06\\xffbfJ\\x02\\x00\\x00\\xffb0\\xffe5\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xffe4I\\xfff3R\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\x0bY\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0\\x15S\\xffff\\x7f\\x00\\x00\\xffb8\\xffcf\\x15S\\xffff\\x7f\\x00\\x00 [\\x06\\xffbfJ\\x02\\x00\\x00\\xfff8\\xff81\\x15S\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00J\\x02\\x00\\x00h\\xffd0\\x15S\\xffff\\x7f\\x00\\x00t\\x03\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0\\x15S\\xffff\\x7f\\x00\\x00\\xffa0\\xffe5\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xff98\\xff85\\x15S\\xffff\\x7f\\x00\\x00\\xffb0\\xffe5\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xffc0r\\x07\\xffbfJ\\x02\\x00\\x00\\xffb0t\\x04\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffb0\\xffe7\\xffbf\\x0b\\xffae\\x00\\x00\\x00 [\\x06\\xffbfJ\\x02\\x00\\x00\\xff90Y\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\xffdcr\\x07\\xffbfJ\\x02\\x00\\x000\\x00\\x00\\x00J\\x02\\x00\\x00t\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe5\\xffbf\\x0b\\xffae\\x00\\x00\\x00@\\x00\\x00\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10[\\x06\\xffbfJ\\x02\\x00\\x00\\x19h\\x04\\xff97\\xffff\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1650
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ExePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath"
              }
            ],
            "repeated": 0,
            "id": 1651
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1652
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "CommandLine"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine"
              }
            ],
            "repeated": 0,
            "id": 1653
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "IdentityType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType"
              }
            ],
            "repeated": 0,
            "id": 1654
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x000000ea",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Type",
                "value": "0x7fff00000003"
              },
              {
                "name": "DataLength",
                "value": "184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1655
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96503e41",
            "parentcaller": "0x7fff965843b9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffff80000005",
            "pretty_return": "BUFFER_OVERFLOW",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1656
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1657
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96503e41",
            "parentcaller": "0x7fff9658448f",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1658
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c9d80",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ActivatableClasses"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses"
              }
            ],
            "repeated": 0,
            "id": 1659
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1660
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              }
            ],
            "repeated": 0,
            "id": 1661
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ServerType"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType"
              }
            ],
            "repeated": 0,
            "id": 1662
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1663
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "AppId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId"
              }
            ],
            "repeated": 0,
            "id": 1664
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              }
            ],
            "repeated": 0,
            "id": 1665
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1666
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ServiceName"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName"
              }
            ],
            "repeated": 0,
            "id": 1667
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1668
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ExplicitPsmActivationType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType"
              }
            ],
            "repeated": 0,
            "id": 1669
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1670
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1671
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 1672
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1673
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1674
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1675
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1676
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf081000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1677
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1678
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf082000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1679
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf083000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1680
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1681
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1682
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1683
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1684
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1685
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1686
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              }
            ],
            "repeated": 0,
            "id": 1687
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1688
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1689
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xb1\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x80\\xb2\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1690
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1691
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1692
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1693
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1694
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1695
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xb1\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x80\\xb2\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1696
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1697
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1698
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1699
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1700
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1701
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1702
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1703
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              }
            ],
            "repeated": 0,
            "id": 1704
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1705
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              }
            ],
            "repeated": 0,
            "id": 1706
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1707
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 1708
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xaf\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xb0\\xb0\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1709
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1710
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1711
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1712
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1713
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc1\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00p\\xc2\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1714
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1715
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1716
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1717
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1718
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1719
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1720
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1721
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1722
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xc0\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xc0\\xc1\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1723
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1724
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1725
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocServer32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1726
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1727
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1728
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000466"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1729
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1730
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1731
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1732
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1733
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xc0\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\xc1\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1734
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1735
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1736
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1737
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1738
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1739
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1740
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xc0\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\xc1\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1741
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1742
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1743
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1744
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              }
            ],
            "repeated": 0,
            "id": 1745
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1746
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1747
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xae\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xaf\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1748
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1749
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1750
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1751
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1752
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xae\\xff\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00Z\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xaf\\xff\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1753
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1754
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1755
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1756
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 1757
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1758
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1759
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 1760
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1761
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1762
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1763
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1764
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1765
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1766
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1767
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1768
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000045a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1769
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1770
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1771
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              }
            ],
            "repeated": 0,
            "id": 1772
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1773
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1774
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              }
            ],
            "repeated": 0,
            "id": 1775
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1776
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1777
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1778
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 1779
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1780
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1781
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 1782
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              }
            ],
            "repeated": 0,
            "id": 1783
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1784
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1785
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xbc\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xc0\\xbd\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1786
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1787
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1788
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 1789
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1790
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1791
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xbc\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xc0\\xbd\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1792
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8f850000"
              }
            ],
            "repeated": 0,
            "id": 1793
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1794
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1795
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 1796
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 1797
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 1798
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 1799
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1800
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xbc\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00V\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\xbd\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1801
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1802
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000456"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 1803
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000456"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 1804
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x00000482"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 1805
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9702ad4d",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000482"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 1806
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000482"
              }
            ],
            "repeated": 0,
            "id": 1807
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1808
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"
              }
            ],
            "repeated": 0,
            "id": 1809
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9709f8f8",
            "parentcaller": "0x7fff9702213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 1810
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff97022160",
            "parentcaller": "0x7fff97019277",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1811
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1812
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1813
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8f850000"
              }
            ],
            "repeated": 0,
            "id": 1814
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff8f850000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 1815
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8f850000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8f866540"
              }
            ],
            "repeated": 0,
            "id": 1816
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8f850000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1817
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8f850000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8f8665f0"
              }
            ],
            "repeated": 0,
            "id": 1818
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b820000"
              }
            ],
            "repeated": 0,
            "id": 1819
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8b820000"
              }
            ],
            "repeated": 0,
            "id": 1820
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff8b820000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 1821
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.StateRepositoryPS.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8b820000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8b827340"
              }
            ],
            "repeated": 0,
            "id": 1822
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.StateRepositoryPS.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8b820000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1823
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.StateRepositoryPS.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8b820000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8b827380"
              }
            ],
            "repeated": 0,
            "id": 1824
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1825
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1826
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff9701c76f",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Status",
                "value": "Log limit reached"
              }
            ],
            "repeated": 0,
            "id": 1827
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1828
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12232",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1829
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1830
          },
          {
            "timestamp": "2026-05-28 22:32:08,609",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}"
              }
            ],
            "repeated": 0,
            "id": 1831
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}"
              }
            ],
            "repeated": 0,
            "id": 1832
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1833
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047e"
              }
            ],
            "repeated": 0,
            "id": 1834
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000436"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1835
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1836
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1837
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1838
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              }
            ],
            "repeated": 0,
            "id": 1839
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              }
            ],
            "repeated": 0,
            "id": 1840
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1841
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1842
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.Package"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package"
              }
            ],
            "repeated": 0,
            "id": 1843
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000434"
              },
              {
                "name": "KeyInformation",
                "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00P\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00P\\x00a\\x00c\\x00k\\x00a\\x00g\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffe9\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00 \\x0c\\x06\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x0fv\\x0f\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10r\\x04\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00 \\x0c\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00 \\x0c\\x06\\xffbfJ\\x02\\x00\\x00\\x10r\\x04\\xffbfJ\\x02\\x00\\x00 \\x1d\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10r\\x04\\xffbfJ\\x02\\x00\\x00\\x00\r\\x06\\xffbfJ\\x02\\x00\\x00\\x00\r\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x0c\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00 \\x0c\\x06\\xffbfJ\\x02\\x00\\x00 \\x1d\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffea\\xffbf\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1844
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1845
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 1846
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server"
              }
            ],
            "repeated": 0,
            "id": 1847
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 1848
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading"
              }
            ],
            "repeated": 0,
            "id": 1849
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 1850
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000434"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 1851
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1852
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 1853
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 1854
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 1855
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 1856
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 1857
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 1858
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 1859
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1860
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf085000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1861
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf086000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1862
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1863
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}"
              }
            ],
            "repeated": 0,
            "id": 1864
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000436"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1865
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1866
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046e"
              }
            ],
            "repeated": 0,
            "id": 1867
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000436"
              }
            ],
            "repeated": 0,
            "id": 1868
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1869
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1870
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1871
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1872
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1873
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1874
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}"
              },
              {
                "name": "Handle",
                "value": "0x00000456"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}"
              }
            ],
            "repeated": 0,
            "id": 1875
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000456"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000482"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1876
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1877
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000482"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1878
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000482"
              }
            ],
            "repeated": 0,
            "id": 1879
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000456"
              }
            ],
            "repeated": 0,
            "id": 1880
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1881
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1882
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1883
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}"
              },
              {
                "name": "Handle",
                "value": "0x00000436"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}"
              }
            ],
            "repeated": 0,
            "id": 1884
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000436"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000046e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1885
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98d0e53f",
            "parentcaller": "0x7fff98c6faf7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1886
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "capauthz.dll"
              }
            ],
            "repeated": 0,
            "id": 1887
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\capauthz.dll"
              }
            ],
            "repeated": 0,
            "id": 1888
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98cafa80",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000454"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\capauthz.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 1889
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafcfe",
            "parentcaller": "0x7fff98cafa80",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000454"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\capauthz.dll"
              }
            ],
            "repeated": 0,
            "id": 1890
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1891
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000480"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e6a0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00051000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1892
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047e"
              }
            ],
            "repeated": 0,
            "id": 1893
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1894
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1895
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1896
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffb5",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e6d8000"
              },
              {
                "name": "ModuleName",
                "value": "capauthz.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1897
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e6d8000"
              },
              {
                "name": "ModuleName",
                "value": "capauthz.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1898
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1899
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e6d8000"
              },
              {
                "name": "ModuleName",
                "value": "capauthz.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1900
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1901
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0a9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1902
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0aa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1903
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "WINTRUST.dll"
              }
            ],
            "repeated": 0,
            "id": 1904
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98v\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1905
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xf4\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xff\\x7f\\x00\\x00\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80[\\x03\\xbf"
              }
            ],
            "repeated": 0,
            "id": 1906
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000484"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96a80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00067000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1907
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1908
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "xt\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1909
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c5fee4",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ae3000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1910
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xf9\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1911
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffb5",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96aca000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1912
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x83\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xd0\\xff\\x0b\\xae\\x00\\x00\\x008\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd0\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1913
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96aca000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1914
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96aca000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1915
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1916
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96aca000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1917
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8y\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1918
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c65082",
            "parentcaller": "0x7fff98c679d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96aca000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1919
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8u\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1920
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1921
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c64485",
            "parentcaller": "0x7fff98c688a8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 1922
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "x\\xfa\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1923
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafd68",
            "parentcaller": "0x7fff98cafa80",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 1924
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xfa\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xca\\xff\\x0b\\xae\\x00\\x00\\x00|\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1925
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98cafa80",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              }
            ],
            "repeated": 0,
            "id": 1926
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1927
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 1928
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96aca000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1929
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e6d8000"
              },
              {
                "name": "ModuleName",
                "value": "capauthz.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1930
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WINTRUST"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96a80000"
              }
            ],
            "repeated": 0,
            "id": 1931
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 1,
            "id": 1932
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1933
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "WindowsDeleteString"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97037690"
              }
            ],
            "repeated": 0,
            "id": 1934
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1935
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 1,
            "id": 1936
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1937
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 2,
            "id": 1938
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}"
              },
              {
                "name": "Handle",
                "value": "0x0000047e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}"
              }
            ],
            "repeated": 0,
            "id": 1939
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000047e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1940
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1941
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1942
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047e"
              }
            ],
            "repeated": 0,
            "id": 1943
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1944
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1945
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1946
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1947
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 1948
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1949
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "Hv\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1950
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xf6\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\\x00T\\x03\\x00\\x00P\\x03\\x00\\x00\\x00\\x00\\x00\\x00p\\x02\\x08\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1951
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1952
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18t\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1953
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1954
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xf9\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1955
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc3\\xb1\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x00\\xda\\xff\\x0b\\xae\\x00\\x00\\x00\\xf8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xc8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xe8\\xd9\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1956
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf9\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd7\\xff\\x0b\\xae\\x00\\x00\\x00X\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1957
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1958
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88r\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xcf\\xf3\\xf1\\xd3\\xe2\\xfa\\xf5\\x84\\x05X\\x00\\x008.\\x00\\x00dP\\xc6\\x975\\x8c\\xd7\\x9bLMEM0\\x00\\x00\\x00\\xe8\\xd4\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1959
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf0\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00o\\x00f\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00o\\x00s\\x00o\\x00f\\x00t\\x00E\\x00d\\x00g\\x00e\\x00.\\x00S\\x00t\\x00a\\x00b\\x00l\\x00e\\x00_\\x008\\x00w\\x00e\\x00k\\x00y\\x00b\\x003\\x00d\\x008\\x00b\\x00b\\x00"
              }
            ],
            "repeated": 0,
            "id": 1960
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1961
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "8{\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1962
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\capauthz"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e6a0000"
              }
            ],
            "repeated": 0,
            "id": 1963
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1964
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "8\\xfb\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1965
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1966
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xfb\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xd4\\xff\\x0b\\xae\\x00\\x00\\x00X\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1967
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 1968
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 1,
            "id": 1969
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}"
              },
              {
                "name": "Handle",
                "value": "0x0000045a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}"
              }
            ],
            "repeated": 0,
            "id": 1970
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000047e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 1971
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 1972
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047e"
              }
            ],
            "repeated": 0,
            "id": 1973
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 1974
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1975
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1976
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1977
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1978
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 1979
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1980
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "Hq\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc3\\x89\\x82\\xff\\x7f\\x00\\x00\\xf0\\xec#\\x97\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1981
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf9\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1982
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964fed78",
            "parentcaller": "0x7fff9654cf77",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1983
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1984
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8w\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1985
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964fed78",
            "parentcaller": "0x7fff9654cf77",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "MutexName",
                "value": ""
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1986
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1987
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1988
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x83\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xd0\\xff\\x0b\\xae\\x00\\x00\\x008\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd0\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1989
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xce\\xff\\x0b\\xae\\x00\\x00\\x00l\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1990
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1991
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "(s\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1992
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ae3000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1993
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0G\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x9d\\xe5iY\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1994
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ae3000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1995
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "hx\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1996
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1997
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98H\\x06\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 1998
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00c\\xa4\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x98\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x88\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 1999
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98d0e53f",
            "parentcaller": "0x7fff98c6faf7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 2000
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90H\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xca\\xff\\x0b\\xae\\x00\\x00\\x00l\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2001
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "MSASN1.dll"
              }
            ],
            "repeated": 0,
            "id": 2002
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2003
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2004
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll"
              }
            ],
            "repeated": 0,
            "id": 2005
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98caf37b",
            "parentcaller": "0x7fff98caf207",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msasn1.dll"
              }
            ],
            "repeated": 0,
            "id": 2006
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2007
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2008
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2009
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2010
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0ad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2011
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2012
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2013
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8u\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2014
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xfb\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2015
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafc9c",
            "parentcaller": "0x7fff98caf7b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000494"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msasn1.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2016
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "hx\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2017
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2018
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2019
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2020
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xd4\\xff\\x0b\\xae\\x00\\x00\\x004\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2021
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2022
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 1,
            "id": 2023
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafcfe",
            "parentcaller": "0x7fff98caf7b0",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000498"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000494"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msasn1.dll"
              }
            ],
            "repeated": 0,
            "id": 2024
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9650aaa8",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa0B\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00@C\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`C\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00tD\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88D\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x90D\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0D\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8D\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8D\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x90C\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x16D\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x1cD\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2025
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9650cbbe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2026
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff9650cbb0",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2027
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9650aa1f",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2028
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9650aaa8",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xa0B\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00@C\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`C\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00tD\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x88D\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x90D\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0D\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xb8D\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8D\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\x90C\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x16D\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00\\x1cD\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2029
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c64d42",
            "parentcaller": "0x7fff98c64aaa",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000498"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e30000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2030
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9650cbbe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 2031
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff827b9183",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              }
            ],
            "repeated": 0,
            "id": 2032
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffb5",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e3a000"
              },
              {
                "name": "ModuleName",
                "value": "MSASN1.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2033
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e3a000"
              },
              {
                "name": "ModuleName",
                "value": "MSASN1.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2034
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e3a000"
              },
              {
                "name": "ModuleName",
                "value": "MSASN1.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2035
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e3a000"
              },
              {
                "name": "ModuleName",
                "value": "MSASN1.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2036
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c65082",
            "parentcaller": "0x7fff98c679d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e3a000"
              },
              {
                "name": "ModuleName",
                "value": "MSASN1.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2037
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafd68",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 2038
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cafd71",
            "parentcaller": "0x7fff98caf7b0",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000494"
              }
            ],
            "repeated": 0,
            "id": 2039
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e3a000"
              },
              {
                "name": "ModuleName",
                "value": "MSASN1.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2040
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\MSASN1"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95e30000"
              }
            ],
            "repeated": 0,
            "id": 2041
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2042
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2043
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2044
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2045
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf087000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2046
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msasn1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95e30000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff95e35860"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 2047
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ae3000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2048
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96ae3000"
              },
              {
                "name": "ModuleName",
                "value": "WINTRUST.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2049
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff95e357f9",
            "parentcaller": "0x7fff95e356a6",
            "category": "registry",
            "api": "RegOpenKeyExA",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1"
              }
            ],
            "repeated": 0,
            "id": 2050
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff95e357f9",
            "parentcaller": "0x7fff95e356a6",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wintrust"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96a80000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96a91670"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 2051
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\capauthz"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e6a0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8e6d2fd0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 2052
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2053
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff84d5f000"
              },
              {
                "name": "ModuleName",
                "value": "execmodelclient.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2054
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6a68cd",
            "parentcaller": "0x7fff8e6a4292",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\SecurityManager\\CapAuthz"
              },
              {
                "name": "Handle",
                "value": "0x00000458"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz"
              }
            ],
            "repeated": 0,
            "id": 2055
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6a6915",
            "parentcaller": "0x7fff8e6a4292",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x0000000e",
                "pretty_value": "KEY_SET_VALUE|KEY_CREATE_SUB_KEY|KEY_ENUMERATE_SUB_KEYS"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2056
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6a695a",
            "parentcaller": "0x7fff8e6a4292",
            "category": "registry",
            "api": "RegCreateKeyExW",
            "status": false,
            "return": "0x000003fd",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Access",
                "value": "0x00000002",
                "pretty_value": "KEY_SET_VALUE"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest"
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 2057
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6a6b50",
            "parentcaller": "0x7fff8e6a4292",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000458"
              }
            ],
            "repeated": 0,
            "id": 2058
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6a6b7a",
            "parentcaller": "0x7fff8e6a4292",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2059
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2060
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6a6ec9",
            "parentcaller": "0x7fff8e6ab441",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\SecurityManager\\CapDBRedirect"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect"
              }
            ],
            "repeated": 0,
            "id": 2061
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2062
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6ab576",
            "parentcaller": "0x7fff8e6a42f2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe"
              }
            ],
            "repeated": 0,
            "id": 2063
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8f48",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "AppPackageType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType"
              }
            ],
            "repeated": 0,
            "id": 2064
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8fc0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "AppPackageType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType"
              }
            ],
            "repeated": 0,
            "id": 2065
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8f48",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "PackageSid"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid"
              }
            ],
            "repeated": 0,
            "id": 2066
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}"
              },
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}"
              }
            ],
            "repeated": 0,
            "id": 2067
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8fc0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "CapSids"
              },
              {
                "name": "Data",
                "value": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids"
              }
            ],
            "repeated": 0,
            "id": 2068
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8f48",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ApplicationFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags"
              }
            ],
            "repeated": 0,
            "id": 2069
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8fc0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ApplicationFlags"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags"
              }
            ],
            "repeated": 0,
            "id": 2070
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2071
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6abcde",
            "parentcaller": "0x7fff8e6a42f2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2072
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a6"
              }
            ],
            "repeated": 0,
            "id": 2073
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff84d09bfa",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2074
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff84d09c3b",
            "parentcaller": "0x7fff84d2d3e7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xf5\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x053\\x00\\x12P\\x00\\xdd\\x8b\\xd2\\x84/\\x00\\x00\\x10t\\x00Q\\x02`\\xf6\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2075
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a2"
              }
            ],
            "repeated": 0,
            "id": 2076
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff84d09cb3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2077
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2078
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2079
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf117000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2080
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900271e2",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps"
              },
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps"
              }
            ],
            "repeated": 0,
            "id": 2081
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 2082
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900272a8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "139296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 2083
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002732c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 2084
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002739f",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 2085
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027402",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 2086
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002755e",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2087
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground_UserInControlOfTheseApps"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2088
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027647",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2089
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002776a",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "Data",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2090
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}"
              },
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}"
              }
            ],
            "repeated": 0,
            "id": 2091
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96503e41",
            "parentcaller": "0x7fff965843b9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicymultiszSeparatorChar"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar"
              }
            ],
            "repeated": 0,
            "id": 2092
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900278f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 2093
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900279b1",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 2094
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027a6c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 2095
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2096
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a6"
              }
            ],
            "repeated": 0,
            "id": 2097
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9002db1b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value"
              }
            ],
            "repeated": 0,
            "id": 2098
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2099
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2100
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027ca8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value"
              }
            ],
            "repeated": 0,
            "id": 2101
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 2102
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90025c61",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 2103
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90025d7c",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 2104
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900271e2",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps"
              },
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps"
              }
            ],
            "repeated": 0,
            "id": 2105
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 2106
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900272a8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "139296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 2107
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002732c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 2108
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002739f",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 2109
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027402",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 2110
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002755e",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2111
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground_ForceAllowTheseApps"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2112
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027647",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2113
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002776a",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "Data",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2114
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900277f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyismultisz"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz"
              }
            ],
            "repeated": 0,
            "id": 2115
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027836",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicymultiszSeparatorChar"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar"
              }
            ],
            "repeated": 0,
            "id": 2116
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900278f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 2117
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900279b1",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 2118
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027a6c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 2119
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9002db1b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value"
              }
            ],
            "repeated": 0,
            "id": 2120
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027ca8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value"
              }
            ],
            "repeated": 0,
            "id": 2121
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 2122
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90025c61",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 2123
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90025d7c",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 2124
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900271e2",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps"
              },
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps"
              }
            ],
            "repeated": 0,
            "id": 2125
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 2126
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900272a8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "139296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 2127
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002732c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 2128
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002739f",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 2129
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027402",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 2130
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002755e",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2131
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground_ForceDenyTheseApps"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2132
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027647",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2133
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002776a",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "Data",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2134
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900277f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyismultisz"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz"
              }
            ],
            "repeated": 0,
            "id": 2135
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027836",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicymultiszSeparatorChar"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar"
              }
            ],
            "repeated": 0,
            "id": 2136
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900278f6",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 2137
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900279b1",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 2138
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027a6c",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 2139
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9002db1b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value"
              }
            ],
            "repeated": 0,
            "id": 2140
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027ca8",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value"
              }
            ],
            "repeated": 0,
            "id": 2141
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90025a59",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 2142
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90025c61",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 2143
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90025d7c",
            "parentcaller": "0x7fff90025ac0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 2144
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900271e2",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground"
              },
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground"
              }
            ],
            "repeated": 0,
            "id": 2145
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002723c",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 2146
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900272a8",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "139296"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 2147
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002732c",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 2148
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002739f",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 2149
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027402",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 2150
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002755e",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2151
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900275df",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "Data",
                "value": "LetAppsRunInBackground"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 2152
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027647",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2153
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9002776a",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicypath"
              },
              {
                "name": "Data",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath"
              }
            ],
            "repeated": 0,
            "id": 2154
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900277f6",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyismultisz"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz"
              }
            ],
            "repeated": 0,
            "id": 2155
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027836",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "grouppolicymultiszSeparatorChar"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar"
              }
            ],
            "repeated": 0,
            "id": 2156
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900278f6",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 2157
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900279b1",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 2158
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027a6c",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 2159
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9002db1b",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value"
              }
            ],
            "repeated": 0,
            "id": 2160
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90027b73",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value"
              }
            ],
            "repeated": 0,
            "id": 2161
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff900276a9",
            "parentcaller": "0x7fff90026abb",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 2162
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90026e85",
            "parentcaller": "0x7fff90026097",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
              }
            ],
            "repeated": 0,
            "id": 2163
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff90026d68",
            "parentcaller": "0x7fff90026097",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy"
              }
            ],
            "repeated": 0,
            "id": 2164
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6a6ec9",
            "parentcaller": "0x7fff8e6ab441",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\SecurityManager\\CapDBRedirect"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect"
              }
            ],
            "repeated": 0,
            "id": 2165
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6ab576",
            "parentcaller": "0x7fff8e6a42f2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe"
              },
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe"
              }
            ],
            "repeated": 0,
            "id": 2166
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8f48",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "AppPackageType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType"
              }
            ],
            "repeated": 0,
            "id": 2167
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8fc0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "AppPackageType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType"
              }
            ],
            "repeated": 0,
            "id": 2168
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8f48",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "PackageSid"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid"
              }
            ],
            "repeated": 0,
            "id": 2169
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8fc0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "PackageSid"
              },
              {
                "name": "Data",
                "value": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid"
              }
            ],
            "repeated": 0,
            "id": 2170
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8f48",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "CapSids"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids"
              }
            ],
            "repeated": 0,
            "id": 2171
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8fc0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "CapSids"
              },
              {
                "name": "Data",
                "value": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids"
              }
            ],
            "repeated": 0,
            "id": 2172
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8f48",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ApplicationFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags"
              }
            ],
            "repeated": 0,
            "id": 2173
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff8e6a8fc0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              },
              {
                "name": "ValueName",
                "value": "ApplicationFlags"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags"
              }
            ],
            "repeated": 0,
            "id": 2174
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6abca8",
            "parentcaller": "0x7fff8e6a42f2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x80000002"
              }
            ],
            "repeated": 0,
            "id": 2175
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff8e6abcde",
            "parentcaller": "0x7fff8e6a42f2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000110"
              }
            ],
            "repeated": 0,
            "id": 2176
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964e26e8",
            "parentcaller": "0x7fff964e132e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf2\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00g\\xe6\tj\\x01\\x00\\x00\\x00r\\xf3n<:\\xf5O\\xa5\\x7fR\\x0eQ"
              }
            ],
            "repeated": 0,
            "id": 2177
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff9650df8a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2178
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff9650df8a",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98c50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2179
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff9650dfa1",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlIsStateSeparationEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cc8560"
              }
            ],
            "repeated": 0,
            "id": 2180
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96503a9c",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 2181
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff965846a3",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE"
              }
            ],
            "repeated": 0,
            "id": 2182
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96503b20",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 2183
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2184
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              }
            ],
            "repeated": 0,
            "id": 2185
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9650db13",
            "parentcaller": "0x7fff9650da55",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 2186
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9650db13",
            "parentcaller": "0x7fff9650da55",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "Data",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 2187
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9650d70a",
            "parentcaller": "0x7fff964e8db6",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2188
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96503a9c",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2189
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2190
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              }
            ],
            "repeated": 0,
            "id": 2191
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9650db13",
            "parentcaller": "0x7fff9650da55",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 2192
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9650db13",
            "parentcaller": "0x7fff9650da55",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "Data",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 2193
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff9650d70a",
            "parentcaller": "0x7fff964e8db6",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2194
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}"
              },
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}"
              }
            ],
            "repeated": 0,
            "id": 2195
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004aa"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2196
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2197
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964e3d26",
            "parentcaller": "0x7fff964e3354",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000004b0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004",
                "pretty_value": "SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x000004ac"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep"
              }
            ],
            "repeated": 0,
            "id": 2198
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964e3d37",
            "parentcaller": "0x7fff964e3354",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2199
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964e3d8e",
            "parentcaller": "0x7fff964e3354",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000004b0"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3e80000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2200
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964e3395",
            "parentcaller": "0x7fff964e3f0a",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3e80000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 2201
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12232",
            "caller": "0x7fff964e341d",
            "parentcaller": "0x7fff964e3f0a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004b0"
              }
            ],
            "repeated": 0,
            "id": 2202
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}"
              },
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}"
              }
            ],
            "repeated": 0,
            "id": 2203
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004ae"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2204
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2205
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004aa"
              }
            ],
            "repeated": 0,
            "id": 2206
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              }
            ],
            "repeated": 0,
            "id": 2207
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2208
          },
          {
            "timestamp": "2026-05-28 22:32:08,625",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2209
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c712f",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 2210
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2211
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2212
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2213
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2214
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "xx\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00M\\x00S\\x00A\\x00S\\x00N\\x001\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2215
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xfb\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\xd1\\x00^O\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00_\\x00F\\x00o\\x00r\\x00c\\x00e\\x00D\\x00e\\x00n\\x00y\\x00T\\x00h\\x00e\\x00s\\x00e\\x00A\\x00p\\x00p\\x00s\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2216
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2217
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "Hq\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2218
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2219
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2220
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x83\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xd0\\xff\\x0b\\xae\\x00\\x00\\x008\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd0\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2221
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xce\\xff\\x0b\\xae\\x00\\x00\\x00\\xa8\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2222
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2223
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "X\\x15\\x06\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc3\\x89\\x82\\xff\\x7f\\x00\\x00\\xf0\\xec#\\x97\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2224
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xfb\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x002\\x001\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x008\\x006\\x000\\x004\\x000\\x00-\\x003\\x002\\x001\\x000\\x002\\x007\\x009\\x004\\x006\\x003\\x00-\\x008\\x004\\x007\\x009\\x007\\x007\\x006\\x000\\x008\\x00-\\x001\\x00"
              }
            ],
            "repeated": 0,
            "id": 2225
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2226
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "8u\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2227
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2228
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xf0\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2229
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00c\\xa4\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x98\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x88\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2230
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xf0\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xca\\xff\\x0b\\xae\\x00\\x00\\x00\\xa8\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2231
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2232
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 1,
            "id": 2233
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x9bw\\xd2\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2234
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff827cb596",
            "parentcaller": "0x7fff98c938c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2235
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff965008ee",
            "parentcaller": "0x7fff827cb5d6",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00001000",
                "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 2236
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff827cb5f6",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2237
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff827cb625",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2238
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff827cb635",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2239
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff827cb644",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2240
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.ApplicationModel.Background.BackgroundTaskRegistration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration"
              }
            ],
            "repeated": 0,
            "id": 2241
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "KeyInformation",
                "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00|\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00T\\x00a\\x00s\\x00k\\x00R\\x00e\\x00g\\x00i\\x00s\\x00t\\x00r\\x00a\\x00t\\x00i\\x00o\\x00n\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\x15\n\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffdf\\%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff87\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00P\\x15\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00P\\x15\n\\xffbfJ\\x02\\x00\\x00\\x10\\xff87\n\\xffbfJ\\x02\\x00\\x00 \\x1d\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff87\n\\xffbfJ\\x02\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x15\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\x15\n\\xffbfJ\\x02\\x00\\x00 \\x1d\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd1\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc6\\x05\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2242
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c5b05",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xec/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12268"
              }
            ],
            "repeated": 0,
            "id": 2243
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2244
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2245
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2246
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98557000"
              },
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2247
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Server"
              }
            ],
            "repeated": 0,
            "id": 2248
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984f84de",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 2249
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\biwinrt.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2250
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2251
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2252
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2253
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2254
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000047c"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2255
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2256
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2257
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2258
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2259
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2260
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2261
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2262
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2263
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 2264
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\biwinrt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d640000"
              }
            ],
            "repeated": 0,
            "id": 2265
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2266
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2267
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\biwinrt.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d640000"
              }
            ],
            "repeated": 0,
            "id": 2268
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7d640000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\biwinrt.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 2269
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "biwinrt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7d640000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7d65bbc0"
              }
            ],
            "repeated": 0,
            "id": 2270
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "biwinrt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7d640000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7d64dd30"
              }
            ],
            "repeated": 0,
            "id": 2271
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "biwinrt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7d640000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7d64ee10"
              }
            ],
            "repeated": 0,
            "id": 2272
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.ApplicationModel.Background.BackgroundWorkManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager"
              }
            ],
            "repeated": 0,
            "id": 2273
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004c4"
              },
              {
                "name": "KeyInformation",
                "value": "[\\xff9a\\xffe5\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00r\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00.\\x00B\\x00a\\x00c\\x00k\\x00g\\x00r\\x00o\\x00u\\x00n\\x00d\\x00W\\x00o\\x00r\\x00k\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd2\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd3\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\x17\n\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffdfA%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff85\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd2\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd2\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\x17\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd2\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\x17\n\\xffbfJ\\x02\\x00\\x00\\xffd0\\xff85\n\\xffbfJ\\x02\\x00\\x00\\x10t\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff85\n\\xffbfJ\\x02\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\x17\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\x17\n\\xffbfJ\\x02\\x00\\x00\\x10t\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd4\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd2\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2274
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2275
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 2276
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\biwinrt.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2277
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2278
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2279
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004c4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2280
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2281
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2282
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2283
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2284
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2285
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2286
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004c4"
              }
            ],
            "repeated": 0,
            "id": 2287
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 2,
            "id": 2288
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2289
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2290
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 2,
            "id": 2291
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}"
              },
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}"
              }
            ],
            "repeated": 0,
            "id": 2292
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004aa"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2293
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2294
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              }
            ],
            "repeated": 0,
            "id": 2295
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004aa"
              }
            ],
            "repeated": 0,
            "id": 2296
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2297
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2298
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2299
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2300
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2301
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2302
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08z\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8R/\\x97\\xff\\x7f\\x00\\x00\\xf0\\xec#\\x97\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2303
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xf2\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\\x00T\\x03\\x00\\x00P\\x03\\x00\\x001\\x000\\x00p\\xdb\\x07\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2304
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2305
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18w\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2306
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2307
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xf2\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2308
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc3\\xb1\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x00\\xda\\xff\\x0b\\xae\\x00\\x00\\x00\\xf8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xc8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xe8\\xd9\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2309
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xf2\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd7\\xff\\x0b\\xae\\x00\\x00\\x00\\xac\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2310
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2311
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8u\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2312
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf3\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00r\\x00e\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00C\\x00u\\x00r\\x00r\\x00e\\x00n\\x00t\\x00V\\x00e\\x00r\\x00s\\x00i\\x00o\\x00n\\x00\\\\x00"
              }
            ],
            "repeated": 0,
            "id": 2313
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2314
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8x\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2315
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2316
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2317
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2318
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xd4\\xff\\x0b\\xae\\x00\\x00\\x00\\xac\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2319
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2320
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 1,
            "id": 2321
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}"
              },
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}"
              }
            ],
            "repeated": 0,
            "id": 2322
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004ae"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2323
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2324
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004aa"
              }
            ],
            "repeated": 0,
            "id": 2325
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              }
            ],
            "repeated": 0,
            "id": 2326
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2327
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2328
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2329
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2330
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2331
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2332
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "(s\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00b\\x00i\\x00w\\x00i\\x00n\\x00r\\x00t\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2333
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xf3\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00r\\x00e\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00s\\x00o\\x00f\\x00t\\x00\\\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00\\\\x00C\\x00u\\x00r\\x00r\\x00e\\x00n\\x00t\\x00V\\x00e\\x00r\\x00s\\x00i\\x00o\\x00n\\x00\\\\x00"
              }
            ],
            "repeated": 0,
            "id": 2334
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2335
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "xw\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2336
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2337
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2338
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc3\\xb1\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x00\\xda\\xff\\x0b\\xae\\x00\\x00\\x00\\xf8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xc8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xe8\\xd9\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2339
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xf4\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd7\\xff\\x0b\\xae\\x00\\x00\\x00\\xa8\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2340
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2341
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "xs\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8R/\\x97\\xff\\x7f\\x00\\x00\\xf0\\xec#\\x97\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2342
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xfc\\x05\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2343
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2344
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88y\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2345
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2346
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8\\xfe\\x05\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2347
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2348
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xfe\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xd4\\xff\\x0b\\xae\\x00\\x00\\x00\\xa8\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2349
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2350
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2351
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8ff61000"
              },
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2352
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8ff61000"
              },
              {
                "name": "ModuleName",
                "value": "OneCoreUAPCommonProxyStub.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2353
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2354
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Foundation.Collections.ValueSet"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet"
              }
            ],
            "repeated": 0,
            "id": 2355
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00N\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00V\\x00a\\x00l\\x00u\\x00e\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00x\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffdb\\xffff\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00_HO\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00x\\xffd3\t\\xffbfJ\\x02\\x00\\x00P\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x000w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00\\xffc0\\xffce\\x05\\xffbfJ\\x02\\x00\\x00\\xffc0\\xffce\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffce\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffa0\\x01\\x06\\xffbfJ\\x02\\x00\\x000w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffdc\\xffff\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc6\\x05\\xffbfJ\\x02\\x00\\x00P\\xffd3\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2356
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2357
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server"
              }
            ],
            "repeated": 0,
            "id": 2358
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2359
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2360
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2361
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2362
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2363
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2364
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2365
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2366
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2367
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2368
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2369
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000045a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000049a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2370
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff92180000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff921890f0"
              }
            ],
            "repeated": 0,
            "id": 2371
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff92180000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff921947b0"
              }
            ],
            "repeated": 0,
            "id": 2372
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2373
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff922bd000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2374
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049a"
              }
            ],
            "repeated": 0,
            "id": 2375
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff922bd000"
              },
              {
                "name": "ModuleName",
                "value": "wintypes.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2376
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045a"
              }
            ],
            "repeated": 0,
            "id": 2377
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2378
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2379
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Storage.Streams.DataWriter"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter"
              }
            ],
            "repeated": 0,
            "id": 2380
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "KeyInformation",
                "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00W\\x00r\\x00i\\x00t\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00x\\xffd9\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffdb\\xffff\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffafIO\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90Y\\x06\\xffbfJ\\x02\\x00\\x00x\\xffd9\t\\xffbfJ\\x02\\x00\\x00P\\xffd9\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd9\t\\xffbfJ\\x02\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\xff90Y\\x06\\xffbfJ\\x02\\x00\\x00\\xffa0u\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90Y\\x06\\xffbfJ\\x02\\x00\\x00\\xffc0\\x0e\\x06\\xffbfJ\\x02\\x00\\x00\\xffc0\\x0e\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0e\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\xffa0u\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffdc\\xffff\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\t\\x06\\xffbfJ\\x02\\x00\\x00P\\xffd9\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2381
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2382
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server"
              }
            ],
            "repeated": 0,
            "id": 2383
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2384
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2385
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2386
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2387
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2388
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2389
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2390
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2391
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff828aa000"
              },
              {
                "name": "ModuleName",
                "value": "wpnapps.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2392
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2393
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c712f",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 2394
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff921a1f48",
            "parentcaller": "0x7fff921a26b1",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2395
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d68f000"
              },
              {
                "name": "ModuleName",
                "value": "biwinrt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2396
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d68f000"
              },
              {
                "name": "ModuleName",
                "value": "biwinrt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2397
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Storage.Streams.DataReader"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader"
              }
            ],
            "repeated": 0,
            "id": 2398
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "KeyInformation",
                "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00D\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00S\\x00t\\x00r\\x00e\\x00a\\x00m\\x00s\\x00.\\x00D\\x00a\\x00t\\x00a\\x00R\\x00e\\x00a\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd0\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffd7\\xffff\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00p\\xffc6\\x05\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffefEO\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd0\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd0\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00p\\xffc6\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd0\t\\xffbfJ\\x02\\x00\\x00p\\xffc6\\x05\\xffbfJ\\x02\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00\\xfff0u\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc6\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00p\\xffc6\\x05\\xffbfJ\\x02\\x00\\x00\\xfff0u\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xffd8\\xffff\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\xffce\\x05\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd0\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2399
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2400
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server"
              }
            ],
            "repeated": 0,
            "id": 2401
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2402
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2403
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2404
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2405
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2406
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2407
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2408
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2409
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2410
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2411
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2412
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Foundation.PropertyValue"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue"
              }
            ],
            "repeated": 0,
            "id": 2413
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a8"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00V\\x00a\\x00l\\x00u\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00x\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffd6\\xffff\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xfffd\\x05\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffffBO\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00x\\xffd3\t\\xffbfJ\\x02\\x00\\x00P\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xfffd\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xfffd\\x05\\xffbfJ\\x02\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00\\xff80w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xfffd\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x06\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xfffd\\x05\\xffbfJ\\x02\\x00\\x00\\xff80w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xffd7\\xffff\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00P\\xffd3\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2414
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2415
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server"
              }
            ],
            "repeated": 0,
            "id": 2416
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2417
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2418
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2419
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2420
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2421
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2422
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2423
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2424
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2425
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2426
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 2427
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0c2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2428
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf10a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2429
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 2,
            "id": 2430
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2431
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96cb7042",
            "parentcaller": "0x7fff96cb6fa4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2432
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}"
              },
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}"
              }
            ],
            "repeated": 0,
            "id": 2433
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004ae"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2434
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2435
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a2"
              }
            ],
            "repeated": 0,
            "id": 2436
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              }
            ],
            "repeated": 0,
            "id": 2437
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2438
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2439
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2440
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2441
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2442
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2443
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "Hq\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\xc0 \\xc8\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2444
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0!\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2445
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2446
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "xz\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2447
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2448
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18!\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2449
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x83\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xd0\\xff\\x0b\\xae\\x00\\x00\\x008\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd0\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2450
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10!\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xce\\xff\\x0b\\xae\\x00\\x00\\x00\\xa0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2451
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2452
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88w\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x08\\x1c \\x92\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2453
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0$\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2454
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2455
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88v\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2456
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2457
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8(\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2458
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00c\\xa4\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x98\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x88\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2459
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0(\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xca\\xff\\x0b\\xae\\x00\\x00\\x00\\xa0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2460
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2461
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 2,
            "id": 2462
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}"
              },
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}"
              }
            ],
            "repeated": 0,
            "id": 2463
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a2"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2464
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2465
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              }
            ],
            "repeated": 0,
            "id": 2466
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a2"
              }
            ],
            "repeated": 0,
            "id": 2467
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2468
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2469
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2470
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2471
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2472
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2473
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18y\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xc0\\xa3\"\\x97\\xff\\x7f\\x00\\x00\\x8cJJ\\xcd\\x0f\\xee\\xed[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc3\\xb4\\xf5H\\xc9\\xaa\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2474
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0$\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2475
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2476
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x88v\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2477
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2478
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8(\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2479
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc3\\xb1\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x00\\xda\\xff\\x0b\\xae\\x00\\x00\\x00\\xf8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xc8\\xd9\\xff\\x0b\\xae\\x00\\x00\\x00\\xe8\\xd9\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2480
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0(\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xd7\\xff\\x0b\\xae\\x00\\x00\\x00\\xac\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2481
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2482
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18t\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00A\\x00c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\\x00a\\x00b\\x00l\\x00e\\x00C\\x00l\\x00a\\x00s\\x00s\\x00\\x01\\x00\\x00\\xc0\\x80\\xe3\\x07\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2483
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " $\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2484
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2485
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18w\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2486
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2487
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98%\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2488
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa3\\xad\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00X\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd6\\xff\\x0b\\xae\\x00\\x00\\x00H\\xd6\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2489
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90%\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xd4\\xff\\x0b\\xae\\x00\\x00\\x00\\xac\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2490
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2491
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 1,
            "id": 2492
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}"
              },
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}"
              }
            ],
            "repeated": 0,
            "id": 2493
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004ae"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2494
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2495
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a2"
              }
            ],
            "repeated": 0,
            "id": 2496
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              }
            ],
            "repeated": 0,
            "id": 2497
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2498
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2499
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2500
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2501
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2502
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2503
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18y\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xc0\\xa3\"\\x97\\xff\\x7f\\x00\\x00\\x8cJJ\\xcd\\x0f\\xee\\xed[\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc3\\xb4\\xf5H\\xc9\\xaa\\\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2504
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@(\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2505
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2506
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "Hw\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2507
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2508
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "x!\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2509
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x83\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xd0\\xff\\x0b\\xae\\x00\\x00\\x008\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd0\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2510
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p!\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xce\\xff\\x0b\\xae\\x00\\x00\\x00\\xa0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2511
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2512
          },
          {
            "timestamp": "2026-05-28 22:32:08,640",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8r\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00b\\x00i\\x00w\\x00i\\x00n\\x00r\\x00t\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2513
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`#\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00uE\\xeeE\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x05\\x00\\x00\\x00\\xebOp8\\\\xc8G\\x15\\x06\\xb0\\xd6\\xa22\\x96\\x14\\x03\\x07H\\x00\\x008.\\x00\\x00\\x91f\\xcd\\xfbQF\\xbbv\\x802\\x05\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2514
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2515
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98{\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2516
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2517
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8)\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2518
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00c\\xa4\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x98\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x88\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2519
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0)\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xca\\xff\\x0b\\xae\\x00\\x00\\x00\\xa0\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2520
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2521
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 2,
            "id": 2522
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0c3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2523
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0c4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2524
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}"
              },
              {
                "name": "Handle",
                "value": "0x000004a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}"
              }
            ],
            "repeated": 0,
            "id": 2525
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a2"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2526
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2527
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ae"
              }
            ],
            "repeated": 0,
            "id": 2528
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a2"
              }
            ],
            "repeated": 0,
            "id": 2529
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2530
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2531
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2532
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 2533
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2534
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2535
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8p\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\xb0\\x01\\x00\\x02\\x00\\x00\\x00\\x13\\x00\r\\x04]\\x88\\x8a\\xeb\\x1c\\xc9\\x11\\x9f\\xe8\\x08\\x00+\\x10H`\\x02\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x0c\\x02\\x00\\x00\\x00\\x01\\x00\\x10\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2536
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0$\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2537
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2538
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8{\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2539
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2540
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "8+\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2541
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x83\\xa7\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xd0\\xff\\x0b\\xae\\x00\\x00\\x008\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00\\x08\\xd0\\xff\\x0b\\xae\\x00\\x00\\x00(\\xd0\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2542
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000+\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xce\\xff\\x0b\\xae\\x00\\x00\\x00\\xac\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2543
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xcc\\xdc\n\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x89\\xdc\n\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2544
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "Hq\n\\xbfJ\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\xc0 \\xc8\\x06\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2545
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80!\\x0c\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2546
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2547
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "Hz\\x07\\xbfJ\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2548
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2549
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18!\\x0c\\xbfJ\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 2550
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00c\\xa4\\x82%\\x7f\\xde\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x98\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00h\\xcc\\xff\\x0b\\xae\\x00\\x00\\x00\\x88\\xcc\\xff\\x0b"
              }
            ],
            "repeated": 0,
            "id": 2551
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10!\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xca\\xff\\x0b\\xae\\x00\\x00\\x00\\xac\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 2552
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2553
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 1,
            "id": 2554
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "WindowsGetStringRawBuffer"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97042340"
              }
            ],
            "repeated": 0,
            "id": 2555
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 3,
            "id": 2556
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2557
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00\\xe8\\x00\\x00\\x00\\xad\\xb5\\xd2\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x19\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x07\\x00\\x00@\\x00\\x00\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "232"
              }
            ],
            "repeated": 0,
            "id": 2558
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0010a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2559
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00(\\xb6\\xd2\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2560
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2561
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x91\\xb7\\xd2\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x001\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2562
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00n\\xb8\\xd2\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2563
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-downlevel-shell32-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 2564
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff984b0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-downlevel-shell32-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2565
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "shcore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff984b0000"
              },
              {
                "name": "FunctionName",
                "value": "CommandLineToArgvW"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff984ceb30"
              }
            ],
            "repeated": 0,
            "id": 2566
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000434"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.ApplicationModel.LimitedAccessFeatures"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures"
              }
            ],
            "repeated": 0,
            "id": 2567
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000434"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00\\\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00L\\x00i\\x00m\\x00i\\x00t\\x00e\\x00d\\x00A\\x00c\\x00c\\x00e\\x00s\\x00s\\x00F\\x00e\\x00a\\x00t\\x00u\\x00r\\x00e\\x00s\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00x\\xffde\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc3\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff8fQ%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff83\n\\xffbfJ\\x02\\x00\\x00x\\xffde\t\\xffbfJ\\x02\\x00\\x00P\\xffde\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffde\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x10\\xff83\n\\xffbfJ\\x02\\x00\\x00\\xffa0p\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff83\n\\xffbfJ\\x02\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffd3\t\\xffbfJ\\x02\\x00\\x00\\xffa0p\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc4\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00P\\xffde\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2568
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2569
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Server"
              }
            ],
            "repeated": 0,
            "id": 2570
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2571
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2572
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2573
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000434"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2574
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2575
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2576
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2577
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2578
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2579
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000434"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2580
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xa8\\xbc\\xd2\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 2581
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12204",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00041000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2582
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xa8\\xbc\\xd2\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 2583
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.ApplicationModel"
              },
              {
                "name": "DllBase",
                "value": "0x7fff85060000"
              }
            ],
            "repeated": 0,
            "id": 2584
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff85060000"
              }
            ],
            "repeated": 0,
            "id": 2585
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff85060000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\Windows.ApplicationModel.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 2586
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff85060000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8506fa40"
              }
            ],
            "repeated": 0,
            "id": 2587
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff85060000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8506e870"
              }
            ],
            "repeated": 0,
            "id": 2588
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff85060000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8506f430"
              }
            ],
            "repeated": 0,
            "id": 2589
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2590
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2591
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2592
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2593
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US"
              }
            ],
            "repeated": 0,
            "id": 2594
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 2595
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000498"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000458"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\en-US\\KernelBase.dll.mui"
              }
            ],
            "repeated": 0,
            "id": 2596
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000498"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb490000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95a780"
              },
              {
                "name": "ViewSize",
                "value": "0x00140000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2597
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 2598
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2599
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2600
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00M\\x00D\\x005\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x005\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x98\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffM\\x00D\\x005\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2601
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\bcryptprimitives.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 2602
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff96c20000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\bcryptprimitives.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 2603
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96c20000"
              },
              {
                "name": "FunctionName",
                "value": "GetHashInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96c34460"
              }
            ],
            "repeated": 0,
            "id": 2604
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2605
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2606
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "31"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X\\xb7\\x95\n\\xae\\x00\\x00\\x00X\\xb7\\x95\n\\xae\\x00\\x00\\x00P\\xd1\t\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\xae\\x00\\x00\\x00\\xb1&\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc5J\\x02\\x00\\x00x\t\\x08\\xbfJ\\x02\\x00\\x00\\x80\\xbd\\x95\n"
              }
            ],
            "repeated": 0,
            "id": 2607
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2608
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 2609
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 2610
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 2611
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 2612
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 2613
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 2614
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2615
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2616
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2617
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2618
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2619
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2620
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 2621
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 2622
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 2623
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 2624
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures"
              }
            ],
            "repeated": 0,
            "id": 2625
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a4"
              },
              {
                "name": "SubKey",
                "value": "com.microsoft.windows.taskbar.requestPinSecondaryTile"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile"
              }
            ],
            "repeated": 0,
            "id": 2626
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 2627
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2628
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "04c19204-10d9-450a-95c4-2910c8f72be3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2629
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2630
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2631
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2632
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8513f000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.ApplicationModel.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2633
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Security.Cryptography.CryptographicBuffer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer"
              }
            ],
            "repeated": 0,
            "id": 2634
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "KeyInformation",
                "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00b\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00i\\x00c\\x00B\\x00u\\x00f\\x00f\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffbd\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffa0@\\x0c\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffcf*%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90Y\\x06\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffa0@\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\xffa0@\\x0c\\xffbfJ\\x02\\x00\\x00\\xff90Y\\x06\\xffbfJ\\x02\\x00\\x00\\x10y\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90Y\\x06\\xffbfJ\\x02\\x00\\x00@\\xffcb\\x05\\xffbfJ\\x02\\x00\\x00@\\xffcb\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0@\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffcb\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffa0@\\x0c\\xffbfJ\\x02\\x00\\x00\\x10y\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffbe\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2635
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2636
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server"
              }
            ],
            "repeated": 0,
            "id": 2637
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\CryptoWinRT.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2638
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2639
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2640
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2641
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2642
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2643
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2644
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2645
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2646
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2647
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 2648
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CryptoWinRT"
              },
              {
                "name": "DllBase",
                "value": "0x7fff70d80000"
              }
            ],
            "repeated": 0,
            "id": 2649
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\CryptoWinRT.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff70d80000"
              }
            ],
            "repeated": 0,
            "id": 2650
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff70d80000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\CryptoWinRT.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 2651
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "CryptoWinRT.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff70d80000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff70d8f560"
              }
            ],
            "repeated": 0,
            "id": 2652
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "CryptoWinRT.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff70d80000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff70d88590"
              }
            ],
            "repeated": 0,
            "id": 2653
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "CryptoWinRT.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff70d80000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff70d85cd0"
              }
            ],
            "repeated": 0,
            "id": 2654
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Security.Cryptography.Core.HashAlgorithmNames"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames"
              }
            ],
            "repeated": 0,
            "id": 2655
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "KeyInformation",
                "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00j\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00H\\x00a\\x00s\\x00h\\x00A\\x00l\\x00g\\x00o\\x00r\\x00i\\x00t\\x00h\\x00m\\x00N\\x00a\\x00m\\x00e\\x00s\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbe\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffe09\\x0c\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffdf*%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0[\\x06\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffe09\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\xffe09\\x0c\\xffbfJ\\x02\\x00\\x00\\xffd0[\\x06\\xffbfJ\\x02\\x00\\x00ps\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0[\\x06\\xffbfJ\\x02\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe09\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffe09\\x0c\\xffbfJ\\x02\\x00\\x00ps\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffbf\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\t\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2656
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2657
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server"
              }
            ],
            "repeated": 0,
            "id": 2658
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\CryptoWinRT.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2659
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2660
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2661
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a0"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2662
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2663
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2664
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2665
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2666
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2667
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2668
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2669
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Security.Cryptography.Core.HashAlgorithmProvider"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider"
              }
            ],
            "repeated": 0,
            "id": 2670
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "KeyInformation",
                "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00.\\x00C\\x00r\\x00y\\x00p\\x00t\\x00o\\x00g\\x00r\\x00a\\x00p\\x00h\\x00y\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00H\\x00a\\x00s\\x00h\\x00A\\x00l\\x00g\\x00o\\x00r\\x00i\\x00t\\x00h\\x00m\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffdb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffbd\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x00;\\x0c\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffcf*%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0X\\x06\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffdb\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00;\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffdb\t\\xffbfJ\\x02\\x00\\x00\\x00;\\x0c\\xffbfJ\\x02\\x00\\x00\\xffd0X\\x06\\xffbfJ\\x02\\x00\\x00\\xff80w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0X\\x06\\xffbfJ\\x02\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00;\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x00;\\x0c\\xffbfJ\\x02\\x00\\x00\\xff80w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffbe\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\t\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdb\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2671
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2672
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server"
              }
            ],
            "repeated": 0,
            "id": 2673
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\CryptoWinRT.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2674
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2675
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2676
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a0"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2677
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2678
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2679
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2680
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2681
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2682
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2683
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2684
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "NtDeviceIoControlFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000001ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\KsecDD"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390400"
              },
              {
                "name": "InputBuffer",
                "value": "M<+\\x1a\\x00\\x00\\x02\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x01\\x00\\x00\\x00\\x02\\x00\\x00\\x00S\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00A\\x002\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xa0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xffS\\x00H\\x00A\\x002\\x005\\x006\\x00\\x00\\x00\\x00\\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00P\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00 \\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00c\\x00r\\x00y\\x00p\\x00t\\x00p\\x00r\\x00i\\x00m\\x00i\\x00t\\x00i\\x00v\\x00e\\x00s\\x00.\\x00d\\x00l\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2685
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "bcryptprimitives.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96c20000"
              },
              {
                "name": "FunctionName",
                "value": "GetHashInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96c34460"
              }
            ],
            "repeated": 0,
            "id": 2686
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Expiration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration"
              }
            ],
            "repeated": 0,
            "id": 2687
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2688
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.ApplicationModel.Core.CoreApplication"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication"
              }
            ],
            "repeated": 0,
            "id": 2689
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00Z\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00C\\x00o\\x00r\\x00e\\x00.\\x00C\\x00o\\x00r\\x00e\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00x\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc1\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff8f/%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0^\\x06\\xffbfJ\\x02\\x00\\x00x\\xffd7\t\\xffbfJ\\x02\\x00\\x00P\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\xffd0^\\x06\\xffbfJ\\x02\\x00\\x00\\xff80w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0^\\x06\\xffbfJ\\x02\\x00\\x000\\xffc8\\x05\\xffbfJ\\x02\\x00\\x000\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffd5\t\\xffbfJ\\x02\\x00\\x00\\xff80w\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc2\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffc2\\x05\\xffbfJ\\x02\\x00\\x00P\\xffd7\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2690
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2691
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server"
              }
            ],
            "repeated": 0,
            "id": 2692
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\twinapi.appcore.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2693
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2694
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2695
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000464"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2696
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2697
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2698
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2699
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2700
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2701
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2702
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2703
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "ApplicationService:2e381dceef1d121b644"
              }
            ],
            "repeated": 0,
            "id": 2704
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2705
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 2706
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2707
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff90dff406",
            "parentcaller": "0x7fff90dc0733",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2708
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004d0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Foundation.Collections.PropertySet"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet"
              }
            ],
            "repeated": 0,
            "id": 2709
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004d0"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00T\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00C\\x00o\\x00l\\x00l\\x00e\\x00c\\x00t\\x00i\\x00o\\x00n\\x00s\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00S\\x00e\\x00t\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffed\\xffef\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00Oz_\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff86\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd7\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\xff90\\xff86\n\\xffbfJ\\x02\\x00\\x00ps\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff86\n\\xffbfJ\\x02\\x00\\x00\\xffa0\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\xffa0\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00ps\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffee\\xffef\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd7\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2710
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2711
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server"
              }
            ],
            "repeated": 0,
            "id": 2712
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2713
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2714
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2715
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004d0"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2716
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2717
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2718
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2719
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2720
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2721
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2722
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              }
            ],
            "repeated": 0,
            "id": 2723
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff90dc91f4",
            "parentcaller": "0x7fff90dc8d56",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2724
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff90dc926f",
            "parentcaller": "0x7fff90dc8d56",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2725
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff90dc1c1b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 2726
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff90dc1d43",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 2727
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff90dc1dc0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 2728
          },
          {
            "timestamp": "2026-05-28 22:32:08,656",
            "thread_id": "12264",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff90dc3b54",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 2729
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff90dedff2",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 2730
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964fed78",
            "parentcaller": "0x7fff90dc1eea",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2731
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff90dda9cc",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2732
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff90dc2239",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2733
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff90dc2239",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2734
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff90dc2239",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2735
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff90dc2239",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2736
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff90e014d3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              }
            ],
            "repeated": 0,
            "id": 2737
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff90e014d3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d4"
              }
            ],
            "repeated": 0,
            "id": 2738
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964fdd5d",
            "parentcaller": "0x7fff90e057fb",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              }
            ],
            "repeated": 0,
            "id": 2739
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff90e014d3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d0"
              }
            ],
            "repeated": 0,
            "id": 2740
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96503a9c",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2741
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2742
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004d4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\XAML"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML"
              }
            ],
            "repeated": 0,
            "id": 2743
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502fe4",
            "parentcaller": "0x7fff90e0154d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d4"
              },
              {
                "name": "ValueName",
                "value": "OneCoreTransformsEnabledByDefault"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault"
              }
            ],
            "repeated": 0,
            "id": 2744
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96503018",
            "parentcaller": "0x7fff90e0154d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d4"
              }
            ],
            "repeated": 0,
            "id": 2745
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff9701ea0e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff980d0000"
              }
            ],
            "repeated": 0,
            "id": 2746
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2747
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3ed0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2748
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3ed0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2749
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2750
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xb6\\x06\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2751
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 2752
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "ApplicationService:2e381dceef1d121b644"
              }
            ],
            "repeated": 0,
            "id": 2753
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0007",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_WRITE"
              },
              {
                "name": "ObjectAttributes",
                "value": "ApplicationService:2e381dceef1d121b644"
              },
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2754
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000464"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3fd0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95c830"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2755
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3fd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2756
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.UI.StartScreen.SecondaryTile"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile"
              }
            ],
            "repeated": 0,
            "id": 2757
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "KeyInformation",
                "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00H\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00.\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00a\\x00r\\x00y\\x00T\\x00i\\x00l\\x00e\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc4\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00?S%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff8e\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00P\\xff8e\n\\xffbfJ\\x02\\x00\\x00\\xff90v\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff8e\n\\xffbfJ\\x02\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffb0\\x0b\\x06\\xffbfJ\\x02\\x00\\x00\\xff90v\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\\xffc5\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x0c\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd6\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2758
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2759
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server"
              }
            ],
            "repeated": 0,
            "id": 2760
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\wpnapps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2761
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2762
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2763
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004a0"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2764
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2765
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2766
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2767
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2768
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2769
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2770
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 2771
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2772
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2773
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2774
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2775
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2776
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2777
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa1\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00<.\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 2778
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984f84de",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 2779
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.Tiles.SecondaryTileStore"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore"
              }
            ],
            "repeated": 0,
            "id": 2780
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004d8"
              },
              {
                "name": "KeyInformation",
                "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00T\\x00i\\x00l\\x00e\\x00s\\x00.\\x00S\\x00e\\x00c\\x00o\\x00n\\x00d\\x00a\\x00r\\x00y\\x00T\\x00i\\x00l\\x00e\\x00S\\x00t\\x00o\\x00r\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\xffae\\x00\\x00\\x00\r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffeb\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffafy\\x0f\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff8a\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00P\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd6\t\\xffbfJ\\x02\\x00\\x00P\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x10\\xff8a\n\\xffbfJ\\x02\\x00\\x00\\x10y\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff8a\n\\xffbfJ\\x02\\x00\\x00p\\xffcd\\x05\\xffbfJ\\x02\\x00\\x00p\\xffcd\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffcd\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffd6\t\\xffbfJ\\x02\\x00\\x00\\x10y\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffec\\xffbf\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd6\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2781
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2782
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server"
              }
            ],
            "repeated": 0,
            "id": 2783
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\TileDataRepository.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2784
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2785
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-downlevel-shell32-l1-1-0.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 2786
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff984b0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-downlevel-shell32-l1-1-0.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 2787
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 2788
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004d8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2789
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2790
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 2791
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 2792
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2793
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2794
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2795
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2796
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              }
            ],
            "repeated": 0,
            "id": 2797
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2798
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2799
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa1\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00<.\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 2800
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984f84de",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xe8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12264"
              }
            ],
            "repeated": 0,
            "id": 2801
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x9c\\x02\\xd3\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2802
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xc0\\x03\\xd3\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2803
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 1,
            "id": 2804
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xa6\\x04\\xd3\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2805
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xba\\x05\\xd3\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 2806
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 3,
            "id": 2807
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.StateRepository"
              },
              {
                "name": "DllBase",
                "value": "0x7fff89b70000"
              }
            ],
            "repeated": 0,
            "id": 2808
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 3,
            "id": 2809
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\TileDataRepository"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82980000"
              }
            ],
            "repeated": 0,
            "id": 2810
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00001000",
                "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 2811
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff9650cbb0",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004e0"
              }
            ],
            "repeated": 0,
            "id": 2812
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff9650aa1f",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2813
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff9650aaa8",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2814
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9650cbbe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004e0"
              }
            ],
            "repeated": 0,
            "id": 2815
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff9650cbb0",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x000004ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004e0"
              }
            ],
            "repeated": 0,
            "id": 2816
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff9650aa1f",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2817
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff9650aaa8",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00S\\x08\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xa0S\\x08\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0S\\x08\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xd4T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8T\\x08\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xf0T\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10U\\x08\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x18U\\x08\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x008U\\x08\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xf0S\\x08\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00vT\\x08\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00|T\\x08\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2818
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9650cbbe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004e0"
              }
            ],
            "repeated": 0,
            "id": 2819
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff827b9183",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2820
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2821
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2822
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2823
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2824
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\TileDataRepository.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82980000"
              }
            ],
            "repeated": 0,
            "id": 2825
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82980000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\TileDataRepository.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 2826
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "TileDataRepository.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82980000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8299cbe0"
              }
            ],
            "repeated": 0,
            "id": 2827
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "TileDataRepository.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82980000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8298cfe0"
              }
            ],
            "repeated": 0,
            "id": 2828
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "TileDataRepository.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82980000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82981270"
              }
            ],
            "repeated": 0,
            "id": 2829
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 2830
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff8298fde9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 2831
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff829ae80f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 2832
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff829a66f7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2833
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff829ae80f",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004e0"
              }
            ],
            "repeated": 0,
            "id": 2834
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff829a66f7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2835
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a15000"
              },
              {
                "name": "ModuleName",
                "value": "TileDataRepository.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2836
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82a15000"
              },
              {
                "name": "ModuleName",
                "value": "TileDataRepository.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2837
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004e8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 2838
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2839
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.System.Internal.UserManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager"
              }
            ],
            "repeated": 0,
            "id": 2840
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004f0"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00F\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00U\\x00s\\x00e\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\\xffc7\\xffa3\n\\xffae\\x00\\x00\\x00\n\\x00\\x00\\x00\\xffff\\x7f\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00h#\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe2\\xffef\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffc0\\x05\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x7fq_\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00h#\\x06\\xffbfJ\\x02\\x00\\x00@#\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00P\\xffc0\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@#\\x06\\xffbfJ\\x02\\x00\\x00P\\xffc0\\x05\\xffbfJ\\x02\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00\\xffb0y\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00\\xffb0D\n\\xffbfJ\\x02\\x00\\x00\\xffb0D\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffc0\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0D\n\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffc0\\x05\\xffbfJ\\x02\\x00\\x00\\xffb0y\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe3\\xffef\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffc8\\x05\\xffbfJ\\x02\\x00\\x00@#\\x06\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2841
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004ec"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00F\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00U\\x00s\\x00e\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00P\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00h\\x00\\x00\\x00(\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00h*\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffe6\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffcfu\\x0f\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0^\\x06\\xffbfJ\\x02\\x00\\x00h*\\x06\\xffbfJ\\x02\\x00\\x00@*\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@*\\x06\\xffbfJ\\x02\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0^\\x06\\xffbfJ\\x02\\x00\\x00px\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0^\\x06\\xffbfJ\\x02\\x00\\x00p\\xffcd\\x05\\xffbfJ\\x02\\x00\\x00p\\xffcd\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffcd\\x05\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00px\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffe7\\xffbf\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0e\\x06\\xffbfJ\\x02\\x00\\x00@*\\x06\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2842
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ec"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2843
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f0"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 2844
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ec"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "UserManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 2845
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ec"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2846
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f0"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 2847
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f0"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 2848
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004ec"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2849
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004f0"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2850
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f0"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 2851
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ec"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2852
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f0"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 2853
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000478"
              },
              {
                "name": "ObjectAttributesName",
                "value": "UserManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager"
              }
            ],
            "repeated": 0,
            "id": 2854
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00U\\x00s\\x00e\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0C/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffd1\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xffe3\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff90\\xff83\n\\xffbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9fq\\x0f\\xffa8\\xffcf\\xff86\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff86\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffd1\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffd1\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xff90\\xff83\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffd1\t\\xffbfJ\\x02\\x00\\x00\\xff90\\xff83\n\\xffbfJ\\x02\\x00\\x00P\\xff86\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90E\n\\xffbfJ\\x02\\x00\\x00kj\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff88\\xffe4\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xff86\n\\xffbfJ\\x02\\x00\\x00\\x00F\n\\xffbfJ\\x02\\x00\\x00\\x00F\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xff83\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000F\n\\xffbfJ\\x02\\x00\\x00\\xffe3r\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffd1\t\\xffbfJ\\x02\\x00\\x00k\\xff89\\x0e\\xff97\\xffff\\x7f\\x00\\x00\\xffd8\\xffba'\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffd1\t\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffe3\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\x01~\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00E\\xffae\\x0b\\xff97\\xffff\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2855
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004f8"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffcek|\\xffd3\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00U\\x00s\\x00e\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00\\x00\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00>\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0C/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffde\\xffef\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffcfM_\\xffa8\\xffcf\\xff86\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff88\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00\\xffd0\\xff88\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000A\n\\xffbfJ\\x02\\x00\\x00kj\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x008\\xffe0\\xffef\\x0b\\xffae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff88\n\\xffbfJ\\x02\\x00\\x00\\x10B\n\\xffbfJ\\x02\\x00\\x00\\x10B\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\xff84\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@B\n\\xffbfJ\\x02\\x00\\x00\\xffe3r\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00k\\xff89\\x0e\\xff97\\xffff\\x7f\\x00\\x00\\xffd8\\xffba'\\xff97\\xffff\\x7f\\x00\\x00\\xffd0\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\xffa8\\xffdf\\xffef\\x0b\\xffae\\x00\\x00\\x00\\x01~\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00E\\xffae\\x0b\\xff97\\xffff\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2856
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "ExePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath"
              }
            ],
            "repeated": 0,
            "id": 2857
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f8"
              },
              {
                "name": "ValueName",
                "value": "CommandLine"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine"
              }
            ],
            "repeated": 0,
            "id": 2858
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "IdentityType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType"
              }
            ],
            "repeated": 0,
            "id": 2859
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f8"
              },
              {
                "name": "ValueName",
                "value": "IdentityType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType"
              }
            ],
            "repeated": 0,
            "id": 2860
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96503e41",
            "parentcaller": "0x7fff965843b9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x01\\x00\\x14\\x80d\\x00\\x00\\x00p\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x004\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 2861
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c9d80",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "ActivatableClasses"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses"
              }
            ],
            "repeated": 0,
            "id": 2862
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f8"
              },
              {
                "name": "ValueName",
                "value": "ServerType"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType"
              }
            ],
            "repeated": 0,
            "id": 2863
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "ServerType"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType"
              }
            ],
            "repeated": 0,
            "id": 2864
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f8"
              },
              {
                "name": "ValueName",
                "value": "AppId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId"
              }
            ],
            "repeated": 0,
            "id": 2865
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "Identity"
              },
              {
                "name": "Data",
                "value": "nt authority\\system"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity"
              }
            ],
            "repeated": 0,
            "id": 2866
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f8"
              },
              {
                "name": "ValueName",
                "value": "Identity"
              },
              {
                "name": "Data",
                "value": "nt authority\\system"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity"
              }
            ],
            "repeated": 0,
            "id": 2867
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "ServiceName"
              },
              {
                "name": "Data",
                "value": "UserManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName"
              }
            ],
            "repeated": 0,
            "id": 2868
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              },
              {
                "name": "ValueName",
                "value": "ExplicitPsmActivationType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType"
              }
            ],
            "repeated": 0,
            "id": 2869
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004f8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 2870
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f4"
              }
            ],
            "repeated": 0,
            "id": 2871
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f8"
              }
            ],
            "repeated": 0,
            "id": 2872
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965043a6",
            "parentcaller": "0x7fff970a7226",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ec"
              }
            ],
            "repeated": 0,
            "id": 2873
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004f0"
              }
            ],
            "repeated": 0,
            "id": 2874
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004f8"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 2875
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004fc"
              }
            ],
            "repeated": 0,
            "id": 2876
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12268",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c5b05",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xec/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12268"
              }
            ],
            "repeated": 0,
            "id": 2877
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2878
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "4977"
              }
            ],
            "repeated": 0,
            "id": 2879
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984f84de",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xe4/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12260"
              }
            ],
            "repeated": 0,
            "id": 2880
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2881
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2882
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2883
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2884
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf088000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2885
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff97016d2f",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000004f4"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 2886
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11416",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800226000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2887
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 2888
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}"
              },
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}"
              }
            ],
            "repeated": 0,
            "id": 2889
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}"
              },
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}"
              }
            ],
            "repeated": 0,
            "id": 2890
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000506"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2891
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000050a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 2892
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2893
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              }
            ],
            "repeated": 0,
            "id": 2894
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              }
            ],
            "repeated": 0,
            "id": 2895
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2896
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              }
            ],
            "repeated": 0,
            "id": 2897
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2898
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              }
            ],
            "repeated": 0,
            "id": 2899
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              }
            ],
            "repeated": 0,
            "id": 2900
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2901
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2902
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              }
            ],
            "repeated": 0,
            "id": 2903
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2904
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2905
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000506"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 2906
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 2907
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2908
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000050a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 2909
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2910
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2911
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2912
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Windows.System.User.ProxyStubFactory"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2913
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2914
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000506"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 2915
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 2916
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000050a"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 2917
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 2918
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2919
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2920
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2921
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xbd\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xbe\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2922
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\usermgrproxy.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2923
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2924
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000506"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 2925
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2926
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2927
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xbd\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xbe\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2928
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              }
            ],
            "repeated": 0,
            "id": 2929
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 2930
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2931
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xb8\\xef\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\n\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xf0\\xb9\\xef\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2932
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              }
            ],
            "repeated": 0,
            "id": 2933
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 2934
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2935
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2936
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2937
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000050a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 2938
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2939
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2940
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              }
            ],
            "repeated": 0,
            "id": 2941
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 2942
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2943
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2944
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xbb\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00p\\xbc\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2945
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000050a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 2946
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2947
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              }
            ],
            "repeated": 0,
            "id": 2948
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2949
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2950
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2951
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2952
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              }
            ],
            "repeated": 0,
            "id": 2953
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2954
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2955
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xb7\\xef\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\n\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00 \\xb8\\xef\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2956
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 2957
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2958
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000050a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 2959
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2960
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 2961
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 2962
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2963
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2964
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\usermgrproxy.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2965
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Windows.System.User.ProxyStubFactory"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2966
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 2967
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050e"
              }
            ],
            "repeated": 0,
            "id": 2968
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000050a"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 2969
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xba\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\xbb\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2970
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 2971
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 2972
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000506"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 2973
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2974
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xba\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\xbb\\xbf\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2975
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff965009b4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004da"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2976
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 2977
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2978
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xb5\\xef\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xda\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x000\\xb6\\xef\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2979
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000506"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 2980
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96503e41",
            "parentcaller": "0x7fff965843b9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004da"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "C:\\Windows\\System32\\usermgrproxy.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 2981
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000506"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 2982
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2983
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xb5\\xef\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\n\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xb0\\xb6\\xef\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2984
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 2985
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2986
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000506"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2987
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000050a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 2988
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xb9\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xba\\xbf\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2989
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2990
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 2991
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xb5\\xef\\x0b\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\n\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xb0\\xb6\\xef\\x0b\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2992
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000506"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 2993
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000050a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 2994
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000050a"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 2995
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 2996
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 2997
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9702ad4d",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000512"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 2998
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 2999
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000512"
              }
            ],
            "repeated": 0,
            "id": 3000
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000050a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3001
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              }
            ],
            "repeated": 0,
            "id": 3002
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000050a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 3003
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              }
            ],
            "repeated": 0,
            "id": 3004
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "Handle",
                "value": "0x000004da"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              }
            ],
            "repeated": 0,
            "id": 3005
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9709f8f8",
            "parentcaller": "0x7fff9702213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000506"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 3006
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff97022160",
            "parentcaller": "0x7fff97019277",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              }
            ],
            "repeated": 0,
            "id": 3007
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9702ad4d",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004da"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 3008
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004da"
              }
            ],
            "repeated": 0,
            "id": 3009
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              }
            ],
            "repeated": 0,
            "id": 3010
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "Handle",
                "value": "0x0000050a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              }
            ],
            "repeated": 0,
            "id": 3011
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff9709f8f8",
            "parentcaller": "0x7fff9702213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000050a"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 3012
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff97022160",
            "parentcaller": "0x7fff97019277",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000050a"
              }
            ],
            "repeated": 0,
            "id": 3013
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3014
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3015
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\usermgrproxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8ecc0000"
              }
            ],
            "repeated": 0,
            "id": 3016
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12260",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c712f",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xe4/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12260"
              }
            ],
            "repeated": 0,
            "id": 3017
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000510"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Storage.ApplicationData"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData"
              }
            ],
            "repeated": 0,
            "id": 3018
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000510"
              },
              {
                "name": "KeyInformation",
                "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00>\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00t\\x00o\\x00r\\x00a\\x00g\\x00e\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00D\\x00a\\x00t\\x00a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1b\\x00\\x00\\x00\\x00\\x00\\x00\\x006\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc9\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffb0 \\x0c\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00OV%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0[\\x06\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffb0 \\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00\\xffb0 \\x0c\\xffbfJ\\x02\\x00\\x00\\xffd0[\\x06\\xffbfJ\\x02\\x00\\x00\\x00z\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0[\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0C\n\\xffbfJ\\x02\\x00\\x00\\xffd0C\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0 \\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0C\n\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffb0 \\x0c\\xffbfJ\\x02\\x00\\x00\\x00z\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffca\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0H\n\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffdd\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3019
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 3020
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server"
              }
            ],
            "repeated": 0,
            "id": 3021
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\usermgrproxy.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8ecc0000"
              }
            ],
            "repeated": 0,
            "id": 3022
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff8ecc0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\usermgrproxy.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 3023
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usermgrproxy.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8ecc0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8eccc750"
              }
            ],
            "repeated": 0,
            "id": 3024
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usermgrproxy.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8ecc0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8ecca040"
              }
            ],
            "repeated": 0,
            "id": 3025
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12232",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usermgrproxy.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff8ecc0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8ecccee0"
              }
            ],
            "repeated": 0,
            "id": 3026
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 3027
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 3028
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "12264",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3029
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000510"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 3030
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 3031
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 3032
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 3033
          },
          {
            "timestamp": "2026-05-28 22:32:08,671",
            "thread_id": "11836",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 3034
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000510"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 3035
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000506"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3036
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051e"
              }
            ],
            "repeated": 0,
            "id": 3037
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3038
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              }
            ],
            "repeated": 0,
            "id": 3039
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              }
            ],
            "repeated": 0,
            "id": 3040
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7c440000"
              }
            ],
            "repeated": 0,
            "id": 3041
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c440000"
              }
            ],
            "repeated": 0,
            "id": 3042
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7c440000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 3043
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7c440000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7c464340"
              }
            ],
            "repeated": 0,
            "id": 3044
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7c440000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7c4520a0"
              }
            ],
            "repeated": 0,
            "id": 3045
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3046
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3047
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12268",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3048
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12268",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3049
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xd2\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00J\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3050
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3051
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3052
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3053
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3054
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3055
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3056
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "99B29D3B-368A-4BE6-B675-805A69114497"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3057
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3058
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3059
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              }
            ],
            "repeated": 0,
            "id": 3060
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 3061
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              }
            ],
            "repeated": 0,
            "id": 3062
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 3063
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              }
            ],
            "repeated": 0,
            "id": 3064
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003b2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 1,
            "id": 3065
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000003b2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}"
              }
            ],
            "repeated": 0,
            "id": 3066
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000504"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}"
              }
            ],
            "repeated": 0,
            "id": 3067
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3068
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3069
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000506"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3070
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000c"
              },
              {
                "name": "TokenHandle",
                "value": "0x000004d8"
              }
            ],
            "repeated": 0,
            "id": 3071
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3072
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3073
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004d8"
              }
            ],
            "repeated": 0,
            "id": 3074
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              }
            ],
            "repeated": 0,
            "id": 3075
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              }
            ],
            "repeated": 0,
            "id": 3076
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3077
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3078
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3079
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_USERS"
              }
            ],
            "repeated": 0,
            "id": 3080
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3081
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3082
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000528"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000046c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR"
              }
            ],
            "repeated": 0,
            "id": 3083
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "WnfStateName"
              },
              {
                "name": "Data",
                "value": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName"
              }
            ],
            "repeated": 0,
            "id": 3084
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff8298dc24",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004e0"
              }
            ],
            "repeated": 0,
            "id": 3085
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              }
            ],
            "repeated": 0,
            "id": 3086
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff8298dc24",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 3087
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3088
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3089
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000528"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000046c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              }
            ],
            "repeated": 0,
            "id": 3090
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "Local AppData"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData"
              }
            ],
            "repeated": 0,
            "id": 3091
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 3092
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "Local AppData"
              },
              {
                "name": "Data",
                "value": "%USERPROFILE%\\AppData\\Local"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData"
              }
            ],
            "repeated": 0,
            "id": 3093
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3094
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3095
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000051c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001"
              }
            ],
            "repeated": 0,
            "id": 3096
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              },
              {
                "name": "ValueName",
                "value": "ProfileImagePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath"
              }
            ],
            "repeated": 0,
            "id": 3097
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              },
              {
                "name": "ValueName",
                "value": "ProfileImagePath"
              },
              {
                "name": "Data",
                "value": "C:\\Users\\admin"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath"
              }
            ],
            "repeated": 0,
            "id": 3098
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051c"
              }
            ],
            "repeated": 0,
            "id": 3099
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              }
            ],
            "repeated": 0,
            "id": 3100
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3101
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3102
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff8298c697",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3103
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff8298c717",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p~\\x07\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00r\\x00s\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3104
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff8298c717",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " }\\x07\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3105
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff829816e6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              }
            ],
            "repeated": 0,
            "id": 3106
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff829816e6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000052c"
              }
            ],
            "repeated": 0,
            "id": 3107
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 3108
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "windows.storage.dll"
              }
            ],
            "repeated": 0,
            "id": 3109
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.storage.dll"
              }
            ],
            "repeated": 0,
            "id": 3110
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000520"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.storage.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3111
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3112
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff96d153ea",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3113
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000052c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000520"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.storage.dll"
              }
            ],
            "repeated": 0,
            "id": 3114
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000052c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94410000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0079b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3115
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000524"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.SecondaryTileView"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView"
              }
            ],
            "repeated": 0,
            "id": 3116
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94a22000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3117
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000528"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.SecondaryTileView"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView"
              }
            ],
            "repeated": 0,
            "id": 3118
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94a22000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3119
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96503e41",
            "parentcaller": "0x7fff965843b9",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 3120
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94a22000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3121
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server"
              }
            ],
            "repeated": 0,
            "id": 3122
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94a22000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3123
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading"
              }
            ],
            "repeated": 0,
            "id": 3124
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading"
              }
            ],
            "repeated": 0,
            "id": 3125
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "Wldp.dll"
              }
            ],
            "repeated": 0,
            "id": 3126
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 3127
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000528"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3128
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000052c"
              }
            ],
            "repeated": 0,
            "id": 3129
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000528"
              },
              {
                "name": "ObjectAttributesName",
                "value": "CustomAttributes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 3130
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 3131
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 3132
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 3133
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 3134
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              }
            ],
            "repeated": 0,
            "id": 3135
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf089000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3136
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000520"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wldp.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 3137
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000052c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000520"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wldp.dll"
              }
            ],
            "repeated": 0,
            "id": 3138
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000052c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0002d000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3139
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3140
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95cc9000"
              },
              {
                "name": "ModuleName",
                "value": "Wldp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3141
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3142
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95cb9000"
              },
              {
                "name": "ModuleName",
                "value": "Wldp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3143
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95cb9000"
              },
              {
                "name": "ModuleName",
                "value": "Wldp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3144
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}"
              },
              {
                "name": "Handle",
                "value": "0x0000052a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}"
              }
            ],
            "repeated": 0,
            "id": 3145
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95cb9000"
              },
              {
                "name": "ModuleName",
                "value": "Wldp.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3146
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000526"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000536"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3147
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000052c"
              }
            ],
            "repeated": 0,
            "id": 3148
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3149
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000520"
              }
            ],
            "repeated": 0,
            "id": 3150
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000051e"
              }
            ],
            "repeated": 0,
            "id": 3151
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000052a"
              }
            ],
            "repeated": 0,
            "id": 3152
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000536"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3153
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3154
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3155
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000536"
              }
            ],
            "repeated": 0,
            "id": 3156
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              }
            ],
            "repeated": 0,
            "id": 3157
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3158
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3159
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000528"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.Application"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application"
              }
            ],
            "repeated": 0,
            "id": 3160
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970add9d",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000524"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.Application"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application"
              }
            ],
            "repeated": 0,
            "id": 3161
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970addf7",
            "parentcaller": "0x7fff97047428",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000524"
              },
              {
                "name": "KeyInformation",
                "value": "y\\x1f\\x10\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00X\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\x02\\x00\\x00\\x00\\x1e\\x00\\x00\\x00-\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1a\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffe6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe7\\xffbf\\x0b\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x7ft\\x0f\\xffa8\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00PZ\\x06\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffe6\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00P\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe6\t\\xffbfJ\\x02\\x00\\x00P\\xffdf\t\\xffbfJ\\x02\\x00\\x00PZ\\x06\\xffbfJ\\x02\\x00\\x00`\\xfff4\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00PZ\\x06\\xffbfJ\\x02\\x00\\x00pM\n\\xffbfJ\\x02\\x00\\x00pM\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffdf\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pM\n\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffdf\t\\xffbfJ\\x02\\x00\\x00`\\xfff4\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffe8\\xffbf\\x0b\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x000A\n\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe6\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3162
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 3163
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 3164
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x04\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00J\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3165
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970b8ff0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server"
              }
            ],
            "repeated": 0,
            "id": 3166
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff97007deb",
            "parentcaller": "0x7fff970c00bb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 3167
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Wldp"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ca0000"
              }
            ],
            "repeated": 0,
            "id": 3168
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading"
              }
            ],
            "repeated": 0,
            "id": 3169
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000528"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 3170
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 3171
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff9700c0fc",
            "parentcaller": "0x7fff970a4170",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000528"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 3172
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 3173
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 3174
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 3175
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970b2222",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 3176
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970a9cb2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 3177
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970a7226",
            "parentcaller": "0x7fff970aca23",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000524"
              }
            ],
            "repeated": 0,
            "id": 3178
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3179
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{D81E96F1-A89C-417E-9335-59531026309D}"
              },
              {
                "name": "Handle",
                "value": "0x0000052e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}"
              }
            ],
            "repeated": 0,
            "id": 3180
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\windows.storage"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94410000"
              }
            ],
            "repeated": 0,
            "id": 3181
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000052e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3182
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3183
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3184
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000506"
              }
            ],
            "repeated": 0,
            "id": 3185
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000052e"
              }
            ],
            "repeated": 0,
            "id": 3186
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3187
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3188
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{D81E96F1-A89C-417E-9335-59531026309D}"
              },
              {
                "name": "Handle",
                "value": "0x0000053a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}"
              }
            ],
            "repeated": 0,
            "id": 3189
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000053a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3190
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3191
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              }
            ],
            "repeated": 0,
            "id": 3192
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000053a"
              }
            ],
            "repeated": 0,
            "id": 3193
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}"
              },
              {
                "name": "Handle",
                "value": "0x0000053a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}"
              }
            ],
            "repeated": 0,
            "id": 3194
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000053a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3195
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3196
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000526"
              }
            ],
            "repeated": 0,
            "id": 3197
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000053a"
              }
            ],
            "repeated": 0,
            "id": 3198
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3199
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3200
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3201
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3202
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 3203
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-eventing-provider-l1-1-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 3204
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "EventSetInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92af0"
              }
            ],
            "repeated": 0,
            "id": 3205
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wldp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ca0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff95ca3200"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3206
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 3207
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\windows.storage"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94410000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff945c92f0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 3208
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}"
              },
              {
                "name": "Handle",
                "value": "0x00000552"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}"
              }
            ],
            "repeated": 0,
            "id": 3209
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3210
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3211
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000552"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000556"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3212
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12264",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0d2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3213
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3214
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000556"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3215
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3216
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000556"
              }
            ],
            "repeated": 0,
            "id": 3217
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000552"
              }
            ],
            "repeated": 0,
            "id": 3218
          },
          {
            "timestamp": "2026-05-28 22:32:08,687",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3219
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3220
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000554"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000006"
              },
              {
                "name": "ObjectAttributes",
                "value": "windows_shell_global_counters"
              }
            ],
            "repeated": 0,
            "id": 3221
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000554"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3ff0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95c840"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3222
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3223
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96fe2000"
              },
              {
                "name": "ModuleName",
                "value": "SHLWAPI.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3224
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000558"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3225
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000558"
              },
              {
                "name": "ValueName",
                "value": "NoPropertiesMyComputer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer"
              }
            ],
            "repeated": 0,
            "id": 3226
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000558"
              }
            ],
            "repeated": 0,
            "id": 3227
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3228
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3229
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "ValueName",
                "value": "NoPropertiesRecycleBin"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin"
              }
            ],
            "repeated": 0,
            "id": 3230
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3231
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3232
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3233
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}"
              },
              {
                "name": "Handle",
                "value": "0x00000562"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}"
              }
            ],
            "repeated": 0,
            "id": 3234
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3235
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 3236
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000562"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000566"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3237
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 3238
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 3239
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000566"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3240
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000566"
              }
            ],
            "repeated": 0,
            "id": 3241
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 3242
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3243
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3244
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 3245
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 3246
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3247
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3248
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3249
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3250
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3251
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3252
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 3253
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              }
            ],
            "repeated": 0,
            "id": 3254
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}"
              },
              {
                "name": "Handle",
                "value": "0x0000056a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}"
              }
            ],
            "repeated": 0,
            "id": 3255
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12264",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}"
              },
              {
                "name": "Handle",
                "value": "0x00000552"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}"
              }
            ],
            "repeated": 0,
            "id": 3256
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3257
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3258
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056a"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000056e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3259
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff965009b4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 3260
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff965009f7",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3261
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12264",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000552"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000572"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3262
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff965009f7",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3263
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 3264
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3265
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              }
            ],
            "repeated": 0,
            "id": 3266
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12264",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000572"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3267
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff965043a6",
            "parentcaller": "0x7fff9709fad3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056e"
              }
            ],
            "repeated": 0,
            "id": 3268
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3269
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056a"
              }
            ],
            "repeated": 0,
            "id": 3270
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12264",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000572"
              }
            ],
            "repeated": 0,
            "id": 3271
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12264",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000552"
              }
            ],
            "repeated": 0,
            "id": 3272
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3273
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3274
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3275
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3276
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "ValueName",
                "value": "NoControlPanel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel"
              }
            ],
            "repeated": 0,
            "id": 3277
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0d4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3278
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3279
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3280
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c712f",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 3281
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3282
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "ValueName",
                "value": "NoSetFolders"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders"
              }
            ],
            "repeated": 0,
            "id": 3283
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3284
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3285
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3286
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "ValueName",
                "value": "NoInternetIcon"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon"
              }
            ],
            "repeated": 0,
            "id": 3287
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3288
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3289
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe"
              }
            ],
            "repeated": 0,
            "id": 3290
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3291
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3292
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000055c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace"
              }
            ],
            "repeated": 0,
            "id": 3293
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "ValueName",
                "value": "ValidateRegItems"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems"
              }
            ],
            "repeated": 0,
            "id": 3294
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3295
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3296
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3297
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000055c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace"
              }
            ],
            "repeated": 0,
            "id": 3298
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "ValueName",
                "value": "MonitorRegistry"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry"
              }
            ],
            "repeated": 0,
            "id": 3299
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3300
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3301
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3302
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3303
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              },
              {
                "name": "ValueName",
                "value": "NoCommonGroups"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups"
              }
            ],
            "repeated": 0,
            "id": 3304
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000055c"
              }
            ],
            "repeated": 0,
            "id": 3305
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3306
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3307
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3308
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3309
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3310
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder"
              },
              {
                "name": "Handle",
                "value": "0x00000562"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder"
              }
            ],
            "repeated": 0,
            "id": 3311
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3312
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3313
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000562"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 3314
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000562"
              },
              {
                "name": "ValueName",
                "value": "CallForAttributes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes"
              }
            ],
            "repeated": 0,
            "id": 3315
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000562"
              },
              {
                "name": "ValueName",
                "value": "RestrictedAttributes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes"
              }
            ],
            "repeated": 0,
            "id": 3316
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000562"
              },
              {
                "name": "ValueName",
                "value": "FolderValueFlags"
              },
              {
                "name": "Data",
                "value": "1581568"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags"
              }
            ],
            "repeated": 0,
            "id": 3317
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000562"
              }
            ],
            "repeated": 0,
            "id": 3318
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3319
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3320
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder"
              }
            ],
            "repeated": 0,
            "id": 3321
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder"
              }
            ],
            "repeated": 0,
            "id": 3322
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum"
              }
            ],
            "repeated": 0,
            "id": 3323
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum"
              },
              {
                "name": "Handle",
                "value": "0x00000560"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum"
              }
            ],
            "repeated": 0,
            "id": 3324
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              },
              {
                "name": "ValueName",
                "value": "{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}"
              }
            ],
            "repeated": 0,
            "id": 3325
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              }
            ],
            "repeated": 0,
            "id": 3326
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3327
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3328
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000560"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace"
              }
            ],
            "repeated": 0,
            "id": 3329
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              },
              {
                "name": "ValueName",
                "value": "ValidateRegItems"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems"
              }
            ],
            "repeated": 0,
            "id": 3330
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              }
            ],
            "repeated": 0,
            "id": 3331
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3332
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3333
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000560"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace"
              }
            ],
            "repeated": 0,
            "id": 3334
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              },
              {
                "name": "ValueName",
                "value": "MonitorRegistry"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry"
              }
            ],
            "repeated": 0,
            "id": 3335
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000560"
              }
            ],
            "repeated": 0,
            "id": 3336
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3337
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3338
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3339
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3340
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3341
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlAreLongPathsEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cc5280"
              }
            ],
            "repeated": 0,
            "id": 3342
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3343
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c4a2000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Storage.ApplicationData.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3344
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d37000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3345
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97d37000"
              },
              {
                "name": "ModuleName",
                "value": "SHELL32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3346
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3347
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0d6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3348
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 3349
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager"
              },
              {
                "name": "Handle",
                "value": "0x00000564"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager"
              }
            ],
            "repeated": 0,
            "id": 3350
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000564"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3351
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 3352
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 3353
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 3354
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 3355
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 3356
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3357
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3358
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3359
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3360
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3361
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3362
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3363
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3364
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 3365
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000564"
              }
            ],
            "repeated": 0,
            "id": 3366
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3367
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3368
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3369
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3370
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Directory"
              },
              {
                "name": "Handle",
                "value": "0x0000056a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Directory"
              }
            ],
            "repeated": 0,
            "id": 3371
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056a"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 3372
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056a"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 1,
            "id": 3373
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000056a"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ShellEx\\LibraryDescriptionHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler"
              }
            ],
            "repeated": 0,
            "id": 3374
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler"
              }
            ],
            "repeated": 0,
            "id": 3375
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Folder"
              },
              {
                "name": "Handle",
                "value": "0x0000056e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Folder"
              }
            ],
            "repeated": 0,
            "id": 3376
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 3377
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3378
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xc2\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00n\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00 \\xc3\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3379
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\LibraryDescriptionHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler"
              }
            ],
            "repeated": 0,
            "id": 3380
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000056e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3381
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000056e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ShellEx\\LibraryDescriptionHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler"
              }
            ],
            "repeated": 0,
            "id": 3382
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "AllFilesystemObjects"
              },
              {
                "name": "Handle",
                "value": "0x00000552"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects"
              }
            ],
            "repeated": 0,
            "id": 3383
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000552"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 3384
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000552"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3385
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xc2\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00R\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00 \\xc3\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3386
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler"
              }
            ],
            "repeated": 0,
            "id": 3387
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000552"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3388
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000552"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ShellEx\\LibraryDescriptionHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler"
              }
            ],
            "repeated": 0,
            "id": 3389
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056a"
              }
            ],
            "repeated": 0,
            "id": 3390
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056e"
              }
            ],
            "repeated": 0,
            "id": 3391
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000552"
              }
            ],
            "repeated": 0,
            "id": 3392
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x7fff945267d0"
              },
              {
                "name": "EventName",
                "value": "Global\\WSearchMigPluginActive"
              }
            ],
            "repeated": 0,
            "id": 3393
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3394
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3395
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa1\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00<.\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "11836"
              }
            ],
            "repeated": 0,
            "id": 3396
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000550"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3397
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984f84de",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 3398
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3399
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\mssprxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8a550000"
              }
            ],
            "repeated": 0,
            "id": 3400
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\mssprxy.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8a550000"
              }
            ],
            "repeated": 0,
            "id": 3401
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff945d8e8e",
            "parentcaller": "0x7fff945df5f2",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "7D096C5F-AC08-4F1F-BEB7-5C22C517CE39"
              },
              {
                "name": "ClsContext",
                "value": "0x00000017",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "AB310581-AC80-11D1-8DF3-00C04FB6EF69"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3402
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3403
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}"
              },
              {
                "name": "Handle",
                "value": "0x0000057e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}"
              }
            ],
            "repeated": 0,
            "id": 3404
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000057e"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000582"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3405
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000582"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3406
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000582"
              }
            ],
            "repeated": 0,
            "id": 3407
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000057e"
              }
            ],
            "repeated": 0,
            "id": 3408
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3409
          },
          {
            "timestamp": "2026-05-28 22:32:08,703",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3410
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}"
              },
              {
                "name": "Handle",
                "value": "0x00000586"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}"
              }
            ],
            "repeated": 0,
            "id": 3411
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000586"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000058a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 3412
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000058a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 3413
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000058a"
              }
            ],
            "repeated": 0,
            "id": 3414
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000586"
              }
            ],
            "repeated": 0,
            "id": 3415
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3416
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3417
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c712f",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 3418
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3419
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3420
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3421
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3422
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3423
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3424
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3425
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3426
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91eb0000"
              }
            ],
            "repeated": 0,
            "id": 3427
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "76765B11-3F95-4AF2-AC9D-EA55D8994F1A"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3428
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3429
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3430
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "1F486A52-3CB1-48FD-8F50-B8DC300D9F9D"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "ECF31D61-E474-453C-BEE7-DE68E441C6D0"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3431
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0d9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3432
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0da000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3433
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0ea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3434
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 3435
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 3436
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2"
              }
            ],
            "repeated": 0,
            "id": 3437
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2"
              }
            ],
            "repeated": 0,
            "id": 3438
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000580"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro"
              }
            ],
            "repeated": 0,
            "id": 3439
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000580"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb5d0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95b9d0"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3440
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000584"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db"
              }
            ],
            "repeated": 0,
            "id": 3441
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000584"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb5e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95c930"
              },
              {
                "name": "ViewSize",
                "value": "0x00049000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3442
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3443
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3444
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\propsys.dll"
              }
            ],
            "repeated": 1,
            "id": 3445
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              }
            ],
            "repeated": 0,
            "id": 3446
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2"
              }
            ],
            "repeated": 0,
            "id": 3447
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Local\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2"
              }
            ],
            "repeated": 0,
            "id": 3448
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro"
              }
            ],
            "repeated": 0,
            "id": 3449
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000588"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb630000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95ba80"
              },
              {
                "name": "ViewSize",
                "value": "0x00004000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3450
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000058c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db"
              }
            ],
            "repeated": 0,
            "id": 3451
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000058c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb640000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95c9e0"
              },
              {
                "name": "ViewSize",
                "value": "0x0009c000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3452
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\SysWOW64\\propsys.dll"
              }
            ],
            "repeated": 1,
            "id": 3453
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\propsys.dll"
              }
            ],
            "repeated": 0,
            "id": 3454
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3455
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3456
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3457
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0db000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3458
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\xaf\r\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x90\\xb0\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb0\r\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xc4\\xb1\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xb1\r\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xe0\\xb1\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb2\r\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08\\xb2\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xb2\r\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xe0\\xb0\r\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00f\\xb1\r\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00l\\xb1\r\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3459
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3460
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xf0\\xaf\r\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\x90\\xb0\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\xb0\r\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\xc4\\xb1\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd8\\xb1\r\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xe0\\xb1\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb2\r\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x08\\xb2\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00(\\xb2\r\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xe0\\xb0\r\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x00f\\xb1\r\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00l\\xb1\r\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3461
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3462
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3463
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3464
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\x05\n\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3465
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000c"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3466
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3467
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3468
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3469
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3470
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000046c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "S-1-5-21-3968686040-3210279463-847977608-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              }
            ],
            "repeated": 0,
            "id": 3471
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Local AppData"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData"
              }
            ],
            "repeated": 0,
            "id": 3472
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Local AppData"
              },
              {
                "name": "Data",
                "value": "%USERPROFILE%\\AppData\\Local"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData"
              }
            ],
            "repeated": 0,
            "id": 3473
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3474
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3475
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000594"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001"
              }
            ],
            "repeated": 0,
            "id": 3476
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "ValueName",
                "value": "ProfileImagePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath"
              }
            ],
            "repeated": 0,
            "id": 3477
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "ValueName",
                "value": "ProfileImagePath"
              },
              {
                "name": "Data",
                "value": "C:\\Users\\admin"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath"
              }
            ],
            "repeated": 0,
            "id": 3478
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              }
            ],
            "repeated": 0,
            "id": 3479
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3480
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3481
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3482
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              }
            ],
            "repeated": 0,
            "id": 3483
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 3484
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "Data",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 3485
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3486
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3487
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000110"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3488
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000110"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx"
              }
            ],
            "repeated": 0,
            "id": 3489
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 3490
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PackageRepositoryRoot"
              },
              {
                "name": "Data",
                "value": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot"
              }
            ],
            "repeated": 0,
            "id": 3491
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3492
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0de000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3493
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3494
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3495
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xf0\\xba\\x95\n\\xae\\x00\\x00\\x00 \\xbb\\x95\n\\xae\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x85\\x11b\\x88\\x18'\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00 w\t\\xbfJ\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xff\\x7f\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xac\\x00\\xb0\\x00\\xae\\x00\\x00\\x00 w\t\\xbfJ\\x02\\x00\\x00\\xd5,\\xc7\\x98\\xff\\x7f\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x89\\xbb\\x95\n\\xae\\x00\\x00\\x000\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xba\\x95\n\\xae\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3496
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3497
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3498
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3499
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3500
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3501
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3502
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3503
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3504
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3505
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3506
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3507
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xf0\\xba\\x95\n\\xae\\x00\\x00\\x00 \\xbb\\x95\n\\xae\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x85\\x11b\\x88\\x18'\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00\\x90+\\x0c\\xbfJ\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00R\\x00V\\x00\\x00\\x00\\x00\\x00\\x90+\\x0c\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xba\\x95\n\\xae\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3508
          },
          {
            "timestamp": "2026-05-28 22:32:08,718",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3509
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3510
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3511
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3512
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfd\\xbeJ\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xf1R\\xff\\x7f\\x00\\x00s\\xdb\\xe8$\\x01\\x00\\x00\\x00\\xfeYP\\x96\\xff\\x7f\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\xd8\\xbe\\x95\n\\xae\\x00\\x00\\x00`\\x11\\xf3R\\xff\\x7f\\x00\\x00\\xcdG\\xc7\\x98\\xff\\x7f\\x00\\x00\\x08\\xae\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\x14S\\xff\\x7f\\x00\\x00\\x93\\xd8\\xe8$\\x7f\\xde\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xf2R\\xff\\x7f\\x00\\x00\\xe0\\xa3\\xa5\\xc0J\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3513
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3514
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3515
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3516
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3517
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3518
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3519
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xf0\\xba\\x95\n\\xae\\x00\\x00\\x00 \\xbb\\x95\n\\xae\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x85\\x11b\\x88\\x18'\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00p\\xf3\t\\xbfJ\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00D\\x00\\x00\\x00\\x00\\x00p\\xf3\t\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xba\\x95\n\\xae\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3520
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3521
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3522
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3523
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3524
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfd\\xbeJ\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xf1R\\xff\\x7f\\x00\\x00s\\xdb\\xe8$\\x01\\x00\\x00\\x00\\xfeYP\\x96\\xff\\x7f\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\xd8\\xbe\\x95\n\\xae\\x00\\x00\\x00`\\x11\\xf3R\\xff\\x7f\\x00\\x00\\xcdG\\xc7\\x98\\xff\\x7f\\x00\\x00\\x08\\xae\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\x14S\\xff\\x7f\\x00\\x00\\x93\\xd8\\xe8$\\x7f\\xde\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xf2R\\xff\\x7f\\x00\\x00\\xe0\\xa3\\xa5\\xc0J\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3525
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3526
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3527
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3528
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3529
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3530
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3531
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xf0\\xba\\x95\n\\xae\\x00\\x00\\x00 \\xbb\\x95\n\\xae\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x85\\x11b\\x88\\x18'\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00\\x10!\r\\xbfJ\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x004\\x008\\x00\\x00\\x00\\x00\\x00\\x10!\r\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xba\\x95\n\\xae\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3532
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3533
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3534
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3535
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3536
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfd\\xbeJ\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xf1R\\xff\\x7f\\x00\\x00s\\xdb\\xe8$\\x01\\x00\\x00\\x00\\xfeYP\\x96\\xff\\x7f\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\xd8\\xbe\\x95\n\\xae\\x00\\x00\\x00`\\x11\\xf3R\\xff\\x7f\\x00\\x00\\xcdG\\xc7\\x98\\xff\\x7f\\x00\\x00\\x08\\xae\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\x14S\\xff\\x7f\\x00\\x00\\x93\\xd8\\xe8$\\x7f\\xde\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xf2R\\xff\\x7f\\x00\\x00\\xe0\\xa3\\xa5\\xc0J\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3537
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3538
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3539
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3540
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3541
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3542
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3543
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xf0\\xba\\x95\n\\xae\\x00\\x00\\x00 \\xbb\\x95\n\\xae\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x85\\x11b\\x88\\x18'\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00\\x80\\x00\n\\xbfJ\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00(\\x00\\x00\\x00\\x00\\x00\\x80\\x00\n\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xba\\x95\n\\xae\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3544
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3545
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3546
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3547
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3548
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfd\\xbeJ\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xf1R\\xff\\x7f\\x00\\x00s\\xdb\\xe8$\\x01\\x00\\x00\\x00\\xfeYP\\x96\\xff\\x7f\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\xd8\\xbe\\x95\n\\xae\\x00\\x00\\x00`\\x11\\xf3R\\xff\\x7f\\x00\\x00\\xcdG\\xc7\\x98\\xff\\x7f\\x00\\x00\\x08\\xae\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\x14S\\xff\\x7f\\x00\\x00\\x93\\xd8\\xe8$\\x7f\\xde\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xf2R\\xff\\x7f\\x00\\x00\\xe0\\xa3\\xa5\\xc0J\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3549
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3550
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3551
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3552
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3553
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": false,
            "return": "0xffffffffc00000ba",
            "pretty_return": "FILE_IS_A_DIRECTORY",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3554
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3555
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xf0\\xba\\x95\n\\xae\\x00\\x00\\x00 \\xbb\\x95\n\\xae\\x00\\x00\\x00\\x80\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\xba\\x00\\x00\\xc0\\xff\\xff\\xff\\xff\\x85\\x11b\\x88\\x18'\\x00\\x00\\x08\\x82\\x15S\\xff\\x7f\\x00\\x00\\xe0\\xa1\\x0e\\xbfJ\\x02\\x00\\x00\\xba\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfakP\\x96\\xff\\x7f\\x00\\x00C\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xbb\\x95\n\\xae\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1c\\x00\\x00\\x00\\x00\\x00\\xe0\\xa1\\x0e\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xba\\x95\n\\xae\\x00\\x00\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3556
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3557
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3558
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3559
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3560
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfd\\xbeJ\\x02\\x00\\x00u\\x02\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9L\\xf1R\\xff\\x7f\\x00\\x00s\\xdb\\xe8$\\x01\\x00\\x00\\x00\\xfeYP\\x96\\xff\\x7f\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x87\\x000Y\\xff\\x7f\\x00\\x00\\xd8\\xbe\\x95\n\\xae\\x00\\x00\\x00`\\x11\\xf3R\\xff\\x7f\\x00\\x00\\xcdG\\xc7\\x98\\xff\\x7f\\x00\\x00\\x08\\xae\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xb8\\xa8\\x14S\\xff\\x7f\\x00\\x00\\x93\\xd8\\xe8$\\x7f\\xde\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00&\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x905\r\\xbfJ\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\xbc+\\xf2R\\xff\\x7f\\x00\\x00\\xe0\\xa3\\xa5\\xc0J\\x02\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3561
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3562
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Users\\"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3563
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x000900a8",
                "pretty_value": "FSCTL_GET_REPARSE_POINT"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3564
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3565
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3566
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 3567
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3568
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3569
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3570
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000590"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 3571
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3572
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "C:\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3573
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3574
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-300300000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3575
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3576
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00&\\x00\\xbc\\x12\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data"
              }
            ],
            "repeated": 0,
            "id": 3577
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              }
            ],
            "repeated": 0,
            "id": 3578
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3579
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000594"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-300300000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3580
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              }
            ],
            "repeated": 0,
            "id": 3581
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 3582
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3583
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3584
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3585
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3586
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xab\\x08\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3587
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3588
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 3589
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3590
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c65157",
            "parentcaller": "0x7fff98c643ea",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000598"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "CFGMGR32.dll"
              }
            ],
            "repeated": 0,
            "id": 3591
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-300300000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3592
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff94575561",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3593
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c5fee4",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96b3b000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3594
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 3595
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c5ffed",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96b29000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3596
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              }
            ],
            "repeated": 0,
            "id": 3597
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c60068",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96b29000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3598
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c6009c",
            "parentcaller": "0x7fff98c5fad8",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96b29000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3599
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c65082",
            "parentcaller": "0x7fff98c679d2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96b28000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3600
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3601
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0eb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3602
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "ValueName",
                "value": "DontShowSuperHidden"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden"
              }
            ],
            "repeated": 0,
            "id": 3603
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000594"
              }
            ],
            "repeated": 0,
            "id": 3604
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96b28000"
              },
              {
                "name": "ModuleName",
                "value": "CFGMGR32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3605
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3606
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c97bac",
            "parentcaller": "0x7fff98c8288a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\CFGMGR32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96af0000"
              }
            ],
            "repeated": 0,
            "id": 3607
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000594"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3608
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000594"
              },
              {
                "name": "SubKey",
                "value": ""
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\"
              }
            ],
            "repeated": 0,
            "id": 3609
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ShellState"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState"
              }
            ],
            "repeated": 0,
            "id": 3610
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ShellState"
              },
              {
                "name": "Data",
                "value": "$\\x00\\x00\\x004(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState"
              }
            ],
            "repeated": 0,
            "id": 3611
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3612
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3613
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "NoWebView"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView"
              }
            ],
            "repeated": 0,
            "id": 3614
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3615
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3616
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3617
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ClassicShell"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell"
              }
            ],
            "repeated": 0,
            "id": 3618
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3619
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3620
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3621
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "SeparateProcess"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess"
              }
            ],
            "repeated": 0,
            "id": 3622
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3623
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3624
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96af5d32",
            "parentcaller": "0x7fff96b03fdd",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000598"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\DeviceApi\\CMApi"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3625
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3626
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3627
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer"
              }
            ],
            "repeated": 0,
            "id": 3628
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3629
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000594"
              },
              {
                "name": "SubKey",
                "value": "Advanced"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"
              }
            ],
            "repeated": 0,
            "id": 3630
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98b65921",
            "parentcaller": "0x7fff96af2e6b",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000598"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470807"
              },
              {
                "name": "InBuffer",
                "value": "(\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00#\\x00\\x00\\xc0|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3631
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Hidden"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden"
              }
            ],
            "repeated": 0,
            "id": 3632
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98b65921",
            "parentcaller": "0x7fff96af1ed1",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x00000598"
              },
              {
                "name": "IoControlCode",
                "value": "0x00470807"
              },
              {
                "name": "InBuffer",
                "value": "(\\x00\\x00\\x00\\x00\\x00\\x01\\x00\rc\\xf5S\\xbf\\xb6\\xd0\\x11\\x94\\xf2\\x00\\xa0\\xc9\\x1e\\xfb\\x8b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x14\\x00\\x00\\x00\\x00\\x00\\x00\\x00|\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00"
              }
            ],
            "repeated": 0,
            "id": 3633
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff94575fb2",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x0000059c"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005a0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 3634
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ShowCompColor"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor"
              }
            ],
            "repeated": 0,
            "id": 3635
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff94575ffc",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3636
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff94575ffc",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              },
              {
                "name": "Milliseconds",
                "value": "1000"
              }
            ],
            "repeated": 0,
            "id": 3637
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "HideFileExt"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt"
              }
            ],
            "repeated": 0,
            "id": 3638
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "DontPrettyPath"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath"
              }
            ],
            "repeated": 0,
            "id": 3639
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ShowInfoTip"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip"
              }
            ],
            "repeated": 0,
            "id": 3640
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "HideIcons"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons"
              }
            ],
            "repeated": 0,
            "id": 3641
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605800228000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3642
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0005c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3643
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "MapNetDrvBtn"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn"
              }
            ],
            "repeated": 0,
            "id": 3644
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "WebView"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView"
              }
            ],
            "repeated": 0,
            "id": 3645
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Filter"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter"
              }
            ],
            "repeated": 0,
            "id": 3646
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3647
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x24abf002340"
              }
            ],
            "repeated": 0,
            "id": 3648
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ShowSuperHidden"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden"
              }
            ],
            "repeated": 0,
            "id": 3649
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff945aa151",
            "parentcaller": "0x7fff945927a5",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3650
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "SeparateProcess"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess"
              }
            ],
            "repeated": 0,
            "id": 3651
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9457601a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 3652
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9459286f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3653
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "NoNetCrawling"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling"
              }
            ],
            "repeated": 0,
            "id": 3654
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "AutoCheckSelect"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect"
              }
            ],
            "repeated": 0,
            "id": 3655
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458f616",
            "parentcaller": "0x7fff9458bf43",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3656
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "IconsOnly"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly"
              }
            ],
            "repeated": 0,
            "id": 3657
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bf7f",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a0"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-100000000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x0000059c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3658
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3659
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ShowStatusBar"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar"
              }
            ],
            "repeated": 0,
            "id": 3660
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3661
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data"
              }
            ],
            "repeated": 0,
            "id": 3662
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3663
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bfeb",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 3664
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3665
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96503a9c",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3666
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9455211d",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3667
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Directory"
              },
              {
                "name": "Handle",
                "value": "0x00000592"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Directory"
              }
            ],
            "repeated": 0,
            "id": 3668
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96503b20",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3669
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000558"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3670
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000059c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000558"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3671
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000059c"
              },
              {
                "name": "ObjectAttributesName",
                "value": "{528c102f-0000-0000-0000-100000000000}\\"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3672
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Folder"
              },
              {
                "name": "Handle",
                "value": "0x0000056e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Folder"
              }
            ],
            "repeated": 0,
            "id": 3673
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 3674
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056e"
              },
              {
                "name": "SubKey",
                "value": "ShellEx\\IconHandler"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler"
              }
            ],
            "repeated": 0,
            "id": 3675
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7fff96503a9c",
            "parentcaller": "0x7fff96503529",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3676
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff98c72caa",
            "parentcaller": "0x7fff98c72fbd",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0ec000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3677
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 3678
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000055e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 3679
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff94575fb2",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005a0"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000059c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 3680
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff94575ffc",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3681
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff94575ffc",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "Milliseconds",
                "value": "1000"
              }
            ],
            "repeated": 0,
            "id": 3682
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056a"
              },
              {
                "name": "ValueName",
                "value": "DocObject"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject"
              }
            ],
            "repeated": 0,
            "id": 3683
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96506bcf",
            "parentcaller": "0x7fff96506883",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              }
            ],
            "repeated": 0,
            "id": 3684
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff9650a580",
            "parentcaller": "0x7fff96506ce2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3685
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96506cc4",
            "parentcaller": "0x7fff96506883",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              }
            ],
            "repeated": 0,
            "id": 3686
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056a"
              },
              {
                "name": "SubKey",
                "value": "DocObject"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject"
              }
            ],
            "repeated": 0,
            "id": 3687
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96504dc6",
            "parentcaller": "0x7fff965068df",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005a8"
              },
              {
                "name": "IoControlCode",
                "value": "0x004d0008",
                "pretty_value": "IOCTL_MOUNTDEV_QUERY_DEVICE_NAME"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": ".\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              }
            ],
            "repeated": 0,
            "id": 3688
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              }
            ],
            "repeated": 0,
            "id": 3689
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96504f8e",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005a8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3690
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96504fcf",
            "parentcaller": "0x7fff965068df",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005a8"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3691
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96504fcf",
            "parentcaller": "0x7fff965068df",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005a8"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0008",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_POINTS"
              },
              {
                "name": "InBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00.\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\xee\\x00\\x00\\x00\\x02\\x00\\x00\\x00r\\x00\\x00\\x00\\x1c\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00\\x8e\\x00\\x00\\x00`\\x00\\x00\\x008\\x00\\x00\\x00\\x0c\\x00\\x00\\x00D\\x00\\x00\\x00.\\x00\\x00\\x00/\\x10\\x8cR\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00\\\\x00H\\x00a\\x00r\\x00d\\x00d\\x00i\\x00s\\x00k\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x002\\x00\\\\x00D\\x00o\\x00s\\x00D\\x00e\\x00v\\x00i\\x00c\\x00e\\x00s\\x00\\\\x00C\\x00:\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00"
              }
            ],
            "repeated": 0,
            "id": 3692
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96504fe3",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              }
            ],
            "repeated": 0,
            "id": 3693
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000592"
              },
              {
                "name": "SubKey",
                "value": "BrowseInPlace"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace"
              }
            ],
            "repeated": 0,
            "id": 3694
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9457601a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3695
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9459286f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 3696
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056e"
              },
              {
                "name": "SubKey",
                "value": "BrowseInPlace"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace"
              }
            ],
            "repeated": 0,
            "id": 3697
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458f616",
            "parentcaller": "0x7fff9458bf43",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x0000059c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3698
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056a"
              },
              {
                "name": "SubKey",
                "value": "BrowseInPlace"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace"
              }
            ],
            "repeated": 0,
            "id": 3699
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bf7f",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000059c"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-300300000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3700
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 3701
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00&\\x00\\xbc\\x12\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data"
              }
            ],
            "repeated": 0,
            "id": 3702
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bfeb",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3703
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458f616",
            "parentcaller": "0x7fff9458bf43",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3704
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bf7f",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a0"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-300300000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3705
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3706
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 3707
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff9458bfeb",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3708
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff94575fb2",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005a0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 3709
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056a"
              },
              {
                "name": "ValueName",
                "value": "IsShortcut"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut"
              }
            ],
            "repeated": 0,
            "id": 3710
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "8132",
            "caller": "0x7fff945aa151",
            "parentcaller": "0x7fff945927a5",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000EDDC00000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3711
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9457601a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3712
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9459286f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3713
          },
          {
            "timestamp": "2026-05-28 22:32:08,734",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000592"
              },
              {
                "name": "ValueName",
                "value": "AlwaysShowExt"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt"
              }
            ],
            "repeated": 0,
            "id": 3714
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bf7f",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a0"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-c0dd0e000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3715
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3716
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x9d\\x7f\\xd7`\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00E\\x00D\\x00D\\x00C\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data"
              }
            ],
            "repeated": 0,
            "id": 3717
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bfeb",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3718
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458f616",
            "parentcaller": "0x7fff9458bf43",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3719
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bf7f",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005ac"
              },
              {
                "name": "SubKey",
                "value": "{528c102f-0000-0000-0000-c0dd0e000000}\\"
              },
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\"
              }
            ],
            "repeated": 0,
            "id": 3720
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3721
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 3722
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056e"
              },
              {
                "name": "ValueName",
                "value": "NeverShowExt"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt"
              }
            ],
            "repeated": 0,
            "id": 3723
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056a"
              },
              {
                "name": "ValueName",
                "value": "NeverShowExt"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt"
              }
            ],
            "repeated": 0,
            "id": 3724
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "8132",
            "caller": "0x7fff945aa151",
            "parentcaller": "0x7fff945927a5",
            "category": "filesystem",
            "api": "GetVolumeNameForVolumeMountPointW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "VolumeMountPoint",
                "value": "\\\\?\\SCSI#CdRom&Ven_<WOOT>&Prod_HL-PQ-SV_WB8#4&35424867&0&010000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\"
              },
              {
                "name": "VolumeName",
                "value": "\\\\?\\Volume{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\"
              }
            ],
            "repeated": 0,
            "id": 3725
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9457601a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3726
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9459286f",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3727
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458f616",
            "parentcaller": "0x7fff9458bf43",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3728
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005ac"
              },
              {
                "name": "SubKey",
                "value": "{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\"
              },
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\"
              }
            ],
            "repeated": 0,
            "id": 3729
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056a"
              }
            ],
            "repeated": 0,
            "id": 3730
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3731
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "ValueName",
                "value": "Data"
              },
              {
                "name": "Data",
                "value": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x80#\\x00\\x00\\x00\\x07\\x02H\\x01\\xfe\\x00\\x00\\x00\\x11\\x00\\x00\\x00x\\x00'\\xca\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00C\\x00S\\x00I\\x00#\\x00C\\x00d\\x00R\\x00o\\x00m\\x00&\\x00V\\x00e\\x00n\\x00_\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00&\\x00P\\x00r\\x00o\\x00d\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00#\\x004\\x00&\\x003\\x005\\x004\\x002\\x004\\x008\\x006\\x007\\x00&\\x000\\x00&\\x000\\x001\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Data"
              }
            ],
            "repeated": 0,
            "id": 3732
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bfeb",
            "parentcaller": "0x7fff945759ad",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3733
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458f616",
            "parentcaller": "0x7fff9458bf43",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000001",
                "pretty_value": "HKEY_CURRENT_USER"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              },
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume"
              }
            ],
            "repeated": 0,
            "id": 3734
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bf7f",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a0"
              },
              {
                "name": "SubKey",
                "value": "{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\"
              }
            ],
            "repeated": 0,
            "id": 3735
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bfa7",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3736
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3737
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff984cb76b",
            "parentcaller": "0x7fff984cb5e2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Generation"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Generation"
              }
            ],
            "repeated": 0,
            "id": 3738
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9458bfeb",
            "parentcaller": "0x7fff94575a2d",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3739
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b86000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3740
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3741
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f54e",
            "parentcaller": "0x7fff9457620d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3742
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3743
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3744
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3745
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3746
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f54e",
            "parentcaller": "0x7fff9457626d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x001\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3747
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3748
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x7f\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3749
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3750
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f54e",
            "parentcaller": "0x7fff9457620d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3751
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f6dd",
            "parentcaller": "0x7fff9457620d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x003\\x000\\x000\\x003\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00C\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3752
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3753
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3754
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              },
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              }
            ],
            "repeated": 0,
            "id": 3755
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3756
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff944c956d",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3757
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff944ca4ff",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xaf\r\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3758
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff944c9591",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3759
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3760
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f54e",
            "parentcaller": "0x7fff9457620d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3761
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3762
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056c"
              },
              {
                "name": "SubKey",
                "value": "{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}"
              }
            ],
            "repeated": 0,
            "id": 3763
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f54e",
            "parentcaller": "0x7fff9457626d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x005\\x002\\x008\\x00c\\x001\\x000\\x002\\x00f\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x000\\x000\\x000\\x000\\x00-\\x00c\\x000\\x00d\\x00d\\x000\\x00e\\x000\\x000\\x000\\x000\\x000\\x000\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3764
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3765
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3766
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3767
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f54e",
            "parentcaller": "0x7fff9457620d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x00c\\x000\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3768
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f6dd",
            "parentcaller": "0x7fff9457620d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x00c\\x000\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00D\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3769
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3770
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Category"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category"
              }
            ],
            "repeated": 0,
            "id": 3771
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506579",
            "parentcaller": "0x7fff96505fe6",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100080",
                "pretty_value": "FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\??\\MountPointManager"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3772
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f54e",
            "parentcaller": "0x7fff9457626d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x00c\\x000\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3773
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9651f6dd",
            "parentcaller": "0x7fff9457626d",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x000005ac"
              },
              {
                "name": "IoControlCode",
                "value": "0x006d0034",
                "pretty_value": "IOCTL_MOUNTMGR_QUERY_DOS_VOLUME_PATHS"
              },
              {
                "name": "InBuffer",
                "value": "`\\x00\\\\x00?\\x00?\\x00\\\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x00c\\x000\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutBuffer",
                "value": "\\x08\\x00\\x00\\x00D\\x00:\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3774
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9651f55e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3775
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff944c956d",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3776
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff944ca4ff",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xaf\r\\xbfJ\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3777
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11416",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff944c9591",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3778
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Data",
                "value": "Start Menu"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name"
              }
            ],
            "repeated": 0,
            "id": 3779
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ParentFolder"
              },
              {
                "name": "Data",
                "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder"
              }
            ],
            "repeated": 0,
            "id": 3780
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Description"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description"
              }
            ],
            "repeated": 0,
            "id": 3781
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "RelativePath"
              },
              {
                "name": "Data",
                "value": "Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath"
              }
            ],
            "repeated": 0,
            "id": 3782
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ParsingName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName"
              }
            ],
            "repeated": 0,
            "id": 3783
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "InfoTip"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip"
              }
            ],
            "repeated": 0,
            "id": 3784
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "LocalizedName"
              },
              {
                "name": "Data",
                "value": "@%SystemRoot%\\system32\\shell32.dll,-21786"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName"
              }
            ],
            "repeated": 0,
            "id": 3785
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Icon"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon"
              }
            ],
            "repeated": 0,
            "id": 3786
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Security"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security"
              }
            ],
            "repeated": 0,
            "id": 3787
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "StreamResource"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource"
              }
            ],
            "repeated": 0,
            "id": 3788
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "StreamResourceType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType"
              }
            ],
            "repeated": 0,
            "id": 3789
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "LocalRedirectOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly"
              }
            ],
            "repeated": 0,
            "id": 3790
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Roamable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable"
              }
            ],
            "repeated": 0,
            "id": 3791
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PreCreate"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate"
              }
            ],
            "repeated": 0,
            "id": 3792
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Stream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream"
              }
            ],
            "repeated": 0,
            "id": 3793
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PublishExpandedPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath"
              }
            ],
            "repeated": 0,
            "id": 3794
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "DefinitionFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags"
              }
            ],
            "repeated": 0,
            "id": 3795
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 3796
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "FolderTypeID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID"
              }
            ],
            "repeated": 0,
            "id": 3797
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "InitFolderHandler"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler"
              }
            ],
            "repeated": 0,
            "id": 3798
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "PropertyBag"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag"
              }
            ],
            "repeated": 0,
            "id": 3799
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3800
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000594"
              },
              {
                "name": "SubKey",
                "value": "SessionInfo\\1"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1"
              }
            ],
            "repeated": 0,
            "id": 3801
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "KnownFolders"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders"
              }
            ],
            "repeated": 0,
            "id": 3802
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3803
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10{\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\x90\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3804
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000590"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3805
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              },
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              }
            ],
            "repeated": 0,
            "id": 3806
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3807
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "ValueName",
                "value": "Start Menu"
              },
              {
                "name": "Data",
                "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu"
              }
            ],
            "repeated": 0,
            "id": 3808
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3809
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3810
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3811
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3812
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x7f\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3813
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              },
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              }
            ],
            "repeated": 0,
            "id": 3814
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000568"
              },
              {
                "name": "SubKey",
                "value": "{A4115719-D62E-491D-AA7C-E74B8BE3B067}"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}"
              }
            ],
            "repeated": 0,
            "id": 3815
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3816
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Category"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category"
              }
            ],
            "repeated": 0,
            "id": 3817
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Data",
                "value": "Common Start Menu"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name"
              }
            ],
            "repeated": 0,
            "id": 3818
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ParentFolder"
              },
              {
                "name": "Data",
                "value": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder"
              }
            ],
            "repeated": 0,
            "id": 3819
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Description"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description"
              }
            ],
            "repeated": 0,
            "id": 3820
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "RelativePath"
              },
              {
                "name": "Data",
                "value": "Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath"
              }
            ],
            "repeated": 0,
            "id": 3821
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "ParsingName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName"
              }
            ],
            "repeated": 0,
            "id": 3822
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "InfoTip"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip"
              }
            ],
            "repeated": 0,
            "id": 3823
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "LocalizedName"
              },
              {
                "name": "Data",
                "value": "@%SystemRoot%\\system32\\shell32.dll,-21786"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName"
              }
            ],
            "repeated": 0,
            "id": 3824
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Icon"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon"
              }
            ],
            "repeated": 0,
            "id": 3825
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Security"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security"
              }
            ],
            "repeated": 0,
            "id": 3826
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "StreamResource"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource"
              }
            ],
            "repeated": 0,
            "id": 3827
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "StreamResourceType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType"
              }
            ],
            "repeated": 0,
            "id": 3828
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "LocalRedirectOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly"
              }
            ],
            "repeated": 0,
            "id": 3829
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Roamable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable"
              }
            ],
            "repeated": 0,
            "id": 3830
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PreCreate"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate"
              }
            ],
            "repeated": 0,
            "id": 3831
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Stream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream"
              }
            ],
            "repeated": 0,
            "id": 3832
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "PublishExpandedPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath"
              }
            ],
            "repeated": 0,
            "id": 3833
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "DefinitionFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags"
              }
            ],
            "repeated": 0,
            "id": 3834
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 3835
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "FolderTypeID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID"
              }
            ],
            "repeated": 0,
            "id": 3836
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "InitFolderHandler"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler"
              }
            ],
            "repeated": 0,
            "id": 3837
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "PropertyBag"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag"
              }
            ],
            "repeated": 0,
            "id": 3838
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3839
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000594"
              },
              {
                "name": "SubKey",
                "value": "SessionInfo\\1"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1"
              }
            ],
            "repeated": 0,
            "id": 3840
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "KnownFolders"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders"
              }
            ],
            "repeated": 0,
            "id": 3841
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3842
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              }
            ],
            "repeated": 0,
            "id": 3843
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "ValueName",
                "value": "Common Start Menu"
              },
              {
                "name": "Data",
                "value": "%ProgramData%\\Microsoft\\Windows\\Start Menu"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu"
              }
            ],
            "repeated": 0,
            "id": 3844
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3845
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3846
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3847
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3848
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x7f\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3849
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              },
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              }
            ],
            "repeated": 0,
            "id": 3850
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056c"
              },
              {
                "name": "SubKey",
                "value": "{AE50C081-EBD2-438A-8655-8A092E34987A}"
              },
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}"
              }
            ],
            "repeated": 0,
            "id": 3851
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3852
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Category"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category"
              }
            ],
            "repeated": 0,
            "id": 3853
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Data",
                "value": "Recent"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name"
              }
            ],
            "repeated": 0,
            "id": 3854
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "ParentFolder"
              },
              {
                "name": "Data",
                "value": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder"
              }
            ],
            "repeated": 0,
            "id": 3855
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Description"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description"
              }
            ],
            "repeated": 0,
            "id": 3856
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "RelativePath"
              },
              {
                "name": "Data",
                "value": "Microsoft\\Windows\\Recent"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath"
              }
            ],
            "repeated": 0,
            "id": 3857
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "ParsingName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName"
              }
            ],
            "repeated": 0,
            "id": 3858
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "InfoTip"
              },
              {
                "name": "Data",
                "value": "@shell32,dll,-12692"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip"
              }
            ],
            "repeated": 0,
            "id": 3859
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "LocalizedName"
              },
              {
                "name": "Data",
                "value": "@%SystemRoot%\\system32\\shell32.dll,-21797"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName"
              }
            ],
            "repeated": 0,
            "id": 3860
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Icon"
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\system32\\imageres.dll,-117"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon"
              }
            ],
            "repeated": 0,
            "id": 3861
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Security"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security"
              }
            ],
            "repeated": 0,
            "id": 3862
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "StreamResource"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource"
              }
            ],
            "repeated": 0,
            "id": 3863
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "StreamResourceType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType"
              }
            ],
            "repeated": 0,
            "id": 3864
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "LocalRedirectOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly"
              }
            ],
            "repeated": 0,
            "id": 3865
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Roamable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable"
              }
            ],
            "repeated": 0,
            "id": 3866
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "PreCreate"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate"
              }
            ],
            "repeated": 0,
            "id": 3867
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Stream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream"
              }
            ],
            "repeated": 0,
            "id": 3868
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "PublishExpandedPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath"
              }
            ],
            "repeated": 0,
            "id": 3869
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "DefinitionFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags"
              }
            ],
            "repeated": 0,
            "id": 3870
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 3871
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "FolderTypeID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID"
              }
            ],
            "repeated": 0,
            "id": 3872
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "InitFolderHandler"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler"
              }
            ],
            "repeated": 0,
            "id": 3873
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000568"
              },
              {
                "name": "SubKey",
                "value": "PropertyBag"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag"
              }
            ],
            "repeated": 0,
            "id": 3874
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3875
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000594"
              },
              {
                "name": "SubKey",
                "value": "SessionInfo\\1"
              },
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1"
              }
            ],
            "repeated": 0,
            "id": 3876
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000568"
              },
              {
                "name": "SubKey",
                "value": "KnownFolders"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders"
              }
            ],
            "repeated": 0,
            "id": 3877
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3878
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10{\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80h\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3879
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000568"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3880
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000568"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              },
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              }
            ],
            "repeated": 0,
            "id": 3881
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3882
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "ValueName",
                "value": "Recent"
              },
              {
                "name": "Data",
                "value": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent"
              }
            ],
            "repeated": 0,
            "id": 3883
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3884
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3885
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3886
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3887
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x7f\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3888
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              }
            ],
            "repeated": 0,
            "id": 3889
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000590"
              },
              {
                "name": "SubKey",
                "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
              },
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
              }
            ],
            "repeated": 0,
            "id": 3890
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000590"
              }
            ],
            "repeated": 0,
            "id": 3891
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Category"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category"
              }
            ],
            "repeated": 0,
            "id": 3892
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Data",
                "value": "Windows"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name"
              }
            ],
            "repeated": 0,
            "id": 3893
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "ParentFolder"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder"
              }
            ],
            "repeated": 0,
            "id": 3894
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Description"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description"
              }
            ],
            "repeated": 0,
            "id": 3895
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "RelativePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath"
              }
            ],
            "repeated": 0,
            "id": 3896
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "ParsingName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName"
              }
            ],
            "repeated": 0,
            "id": 3897
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "InfoTip"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip"
              }
            ],
            "repeated": 0,
            "id": 3898
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "LocalizedName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName"
              }
            ],
            "repeated": 0,
            "id": 3899
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Icon"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon"
              }
            ],
            "repeated": 0,
            "id": 3900
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Security"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security"
              }
            ],
            "repeated": 0,
            "id": 3901
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "StreamResource"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource"
              }
            ],
            "repeated": 0,
            "id": 3902
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "StreamResourceType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType"
              }
            ],
            "repeated": 0,
            "id": 3903
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "LocalRedirectOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly"
              }
            ],
            "repeated": 0,
            "id": 3904
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Roamable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable"
              }
            ],
            "repeated": 0,
            "id": 3905
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "PreCreate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate"
              }
            ],
            "repeated": 0,
            "id": 3906
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Stream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream"
              }
            ],
            "repeated": 0,
            "id": 3907
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "PublishExpandedPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath"
              }
            ],
            "repeated": 0,
            "id": 3908
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "DefinitionFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags"
              }
            ],
            "repeated": 0,
            "id": 3909
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 3910
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "FolderTypeID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID"
              }
            ],
            "repeated": 0,
            "id": 3911
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "ValueName",
                "value": "InitFolderHandler"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler"
              }
            ],
            "repeated": 0,
            "id": 3912
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000568"
              },
              {
                "name": "SubKey",
                "value": "PropertyBag"
              },
              {
                "name": "Handle",
                "value": "0x00000590"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag"
              }
            ],
            "repeated": 0,
            "id": 3913
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3914
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3915
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3916
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3917
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x7f\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3918
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              },
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              }
            ],
            "repeated": 0,
            "id": 3919
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000568"
              },
              {
                "name": "SubKey",
                "value": "{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
              },
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}"
              }
            ],
            "repeated": 0,
            "id": 3920
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000568"
              }
            ],
            "repeated": 0,
            "id": 3921
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Category"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category"
              }
            ],
            "repeated": 0,
            "id": 3922
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Data",
                "value": "System"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name"
              }
            ],
            "repeated": 0,
            "id": 3923
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "ParentFolder"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder"
              }
            ],
            "repeated": 0,
            "id": 3924
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Description"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description"
              }
            ],
            "repeated": 0,
            "id": 3925
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "RelativePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath"
              }
            ],
            "repeated": 0,
            "id": 3926
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "ParsingName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName"
              }
            ],
            "repeated": 0,
            "id": 3927
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "InfoTip"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip"
              }
            ],
            "repeated": 0,
            "id": 3928
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "LocalizedName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName"
              }
            ],
            "repeated": 0,
            "id": 3929
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Icon"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon"
              }
            ],
            "repeated": 0,
            "id": 3930
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Security"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security"
              }
            ],
            "repeated": 0,
            "id": 3931
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "StreamResource"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource"
              }
            ],
            "repeated": 0,
            "id": 3932
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "StreamResourceType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType"
              }
            ],
            "repeated": 0,
            "id": 3933
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "LocalRedirectOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly"
              }
            ],
            "repeated": 0,
            "id": 3934
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Roamable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable"
              }
            ],
            "repeated": 0,
            "id": 3935
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "PreCreate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate"
              }
            ],
            "repeated": 0,
            "id": 3936
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Stream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream"
              }
            ],
            "repeated": 0,
            "id": 3937
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "PublishExpandedPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath"
              }
            ],
            "repeated": 0,
            "id": 3938
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "DefinitionFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags"
              }
            ],
            "repeated": 0,
            "id": 3939
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 3940
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "FolderTypeID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID"
              }
            ],
            "repeated": 0,
            "id": 3941
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "ValueName",
                "value": "InitFolderHandler"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler"
              }
            ],
            "repeated": 0,
            "id": 3942
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a8"
              },
              {
                "name": "SubKey",
                "value": "PropertyBag"
              },
              {
                "name": "Handle",
                "value": "0x00000568"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag"
              }
            ],
            "repeated": 0,
            "id": 3943
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              }
            ],
            "repeated": 0,
            "id": 3944
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3945
          },
          {
            "timestamp": "2026-05-28 22:32:08,750",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3946
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3947
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x7f\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3948
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              },
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              }
            ],
            "repeated": 0,
            "id": 3949
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a8"
              },
              {
                "name": "SubKey",
                "value": "{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}"
              }
            ],
            "repeated": 0,
            "id": 3950
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a8"
              }
            ],
            "repeated": 0,
            "id": 3951
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Category"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category"
              }
            ],
            "repeated": 0,
            "id": 3952
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Data",
                "value": "Personal"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name"
              }
            ],
            "repeated": 0,
            "id": 3953
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "ParentFolder"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder"
              }
            ],
            "repeated": 0,
            "id": 3954
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Description"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description"
              }
            ],
            "repeated": 0,
            "id": 3955
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "RelativePath"
              },
              {
                "name": "Data",
                "value": "Documents"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath"
              }
            ],
            "repeated": 0,
            "id": 3956
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "ParsingName"
              },
              {
                "name": "Data",
                "value": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName"
              }
            ],
            "repeated": 0,
            "id": 3957
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "InfoTip"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip"
              }
            ],
            "repeated": 0,
            "id": 3958
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "LocalizedName"
              },
              {
                "name": "Data",
                "value": "@%SystemRoot%\\system32\\windows.storage.dll,-21770"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName"
              }
            ],
            "repeated": 0,
            "id": 3959
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Icon"
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\system32\\imageres.dll,-112"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon"
              }
            ],
            "repeated": 0,
            "id": 3960
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Security"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security"
              }
            ],
            "repeated": 0,
            "id": 3961
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "StreamResource"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource"
              }
            ],
            "repeated": 0,
            "id": 3962
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "StreamResourceType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType"
              }
            ],
            "repeated": 0,
            "id": 3963
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "LocalRedirectOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly"
              }
            ],
            "repeated": 0,
            "id": 3964
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Roamable"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable"
              }
            ],
            "repeated": 0,
            "id": 3965
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "PreCreate"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate"
              }
            ],
            "repeated": 0,
            "id": 3966
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Stream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream"
              }
            ],
            "repeated": 0,
            "id": 3967
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "PublishExpandedPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath"
              }
            ],
            "repeated": 0,
            "id": 3968
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "DefinitionFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags"
              }
            ],
            "repeated": 0,
            "id": 3969
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 3970
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "FolderTypeID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID"
              }
            ],
            "repeated": 0,
            "id": 3971
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "InitFolderHandler"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler"
              }
            ],
            "repeated": 0,
            "id": 3972
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005ac"
              },
              {
                "name": "SubKey",
                "value": "PropertyBag"
              },
              {
                "name": "Handle",
                "value": "0x000005a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag"
              }
            ],
            "repeated": 0,
            "id": 3973
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3974
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0ed000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3975
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000594"
              },
              {
                "name": "SubKey",
                "value": "SessionInfo\\1"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1"
              }
            ],
            "repeated": 0,
            "id": 3976
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005ac"
              },
              {
                "name": "SubKey",
                "value": "KnownFolders"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders"
              }
            ],
            "repeated": 0,
            "id": 3977
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3978
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10{\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x80\\xac\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3979
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005ac"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 3980
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005ac"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              },
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders"
              }
            ],
            "repeated": 0,
            "id": 3981
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 3982
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "ValueName",
                "value": "Personal"
              },
              {
                "name": "Data",
                "value": "%USERPROFILE%\\Documents"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal"
              }
            ],
            "repeated": 0,
            "id": 3983
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3984
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3985
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 3986
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3987
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P\\x7f\\x95\n\\xae\\x00\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3988
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              },
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions"
              }
            ],
            "repeated": 0,
            "id": 3989
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000056c"
              },
              {
                "name": "SubKey",
                "value": "{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}"
              }
            ],
            "repeated": 0,
            "id": 3990
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000056c"
              }
            ],
            "repeated": 0,
            "id": 3991
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Category"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category"
              }
            ],
            "repeated": 0,
            "id": 3992
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Name"
              },
              {
                "name": "Data",
                "value": "Fonts"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name"
              }
            ],
            "repeated": 0,
            "id": 3993
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "ParentFolder"
              },
              {
                "name": "Data",
                "value": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder"
              }
            ],
            "repeated": 0,
            "id": 3994
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Description"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description"
              }
            ],
            "repeated": 0,
            "id": 3995
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "RelativePath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath"
              }
            ],
            "repeated": 0,
            "id": 3996
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "ParsingName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName"
              }
            ],
            "repeated": 0,
            "id": 3997
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "InfoTip"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip"
              }
            ],
            "repeated": 0,
            "id": 3998
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "LocalizedName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName"
              }
            ],
            "repeated": 0,
            "id": 3999
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Icon"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon"
              }
            ],
            "repeated": 0,
            "id": 4000
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Security"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security"
              }
            ],
            "repeated": 0,
            "id": 4001
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "StreamResource"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource"
              }
            ],
            "repeated": 0,
            "id": 4002
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "StreamResourceType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType"
              }
            ],
            "repeated": 0,
            "id": 4003
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "LocalRedirectOnly"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly"
              }
            ],
            "repeated": 0,
            "id": 4004
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Roamable"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable"
              }
            ],
            "repeated": 0,
            "id": 4005
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "PreCreate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate"
              }
            ],
            "repeated": 0,
            "id": 4006
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Stream"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream"
              }
            ],
            "repeated": 0,
            "id": 4007
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "PublishExpandedPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath"
              }
            ],
            "repeated": 0,
            "id": 4008
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "DefinitionFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags"
              }
            ],
            "repeated": 0,
            "id": 4009
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "Attributes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes"
              }
            ],
            "repeated": 0,
            "id": 4010
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "FolderTypeID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID"
              }
            ],
            "repeated": 0,
            "id": 4011
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "ValueName",
                "value": "InitFolderHandler"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler"
              }
            ],
            "repeated": 0,
            "id": 4012
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005ac"
              },
              {
                "name": "SubKey",
                "value": "PropertyBag"
              },
              {
                "name": "Handle",
                "value": "0x0000056c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag"
              }
            ],
            "repeated": 0,
            "id": 4013
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 4014
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 4015
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4016
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4017
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94b85000"
              },
              {
                "name": "ModuleName",
                "value": "windows.storage.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4018
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4019
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4020
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4021
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4022
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4023
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4024
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 4025
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 4026
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 4027
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 4028
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 4029
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4030
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4031
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a0"
              }
            ],
            "repeated": 0,
            "id": 4032
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Directory"
              },
              {
                "name": "Handle",
                "value": "0x000005a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Directory"
              }
            ],
            "repeated": 0,
            "id": 4033
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005a2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Directory"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4034
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005a2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 1,
            "id": 4035
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005a2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ShellEx\\PropertyHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler"
              }
            ],
            "repeated": 0,
            "id": 4036
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler"
              }
            ],
            "repeated": 0,
            "id": 4037
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Folder"
              },
              {
                "name": "Handle",
                "value": "0x0000059e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Folder"
              }
            ],
            "repeated": 0,
            "id": 4038
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000059e"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\Folder"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4039
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000059e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4040
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xaf\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\x9e\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xb0\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4041
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\Folder\\ShellEx\\PropertyHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler"
              }
            ],
            "repeated": 0,
            "id": 4042
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000059e"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4043
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x0000059e"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ShellEx\\PropertyHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler"
              }
            ],
            "repeated": 0,
            "id": 4044
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "AllFilesystemObjects"
              },
              {
                "name": "Handle",
                "value": "0x000005ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\AllFilesystemObjects"
              }
            ],
            "repeated": 0,
            "id": 4045
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005ae"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4046
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005ae"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4047
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xaf\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xae\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00@\\xb0\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4048
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler"
              }
            ],
            "repeated": 0,
            "id": 4049
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005ae"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4050
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005ae"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ShellEx\\PropertyHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler"
              }
            ],
            "repeated": 0,
            "id": 4051
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a2"
              }
            ],
            "repeated": 0,
            "id": 4052
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059e"
              }
            ],
            "repeated": 0,
            "id": 4053
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ae"
              }
            ],
            "repeated": 0,
            "id": 4054
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager"
              },
              {
                "name": "Handle",
                "value": "0x000005ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager"
              }
            ],
            "repeated": 0,
            "id": 4055
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005ac"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4056
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ac"
              }
            ],
            "repeated": 0,
            "id": 4057
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0ef000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4058
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Drive\\shellex\\FolderExtensions"
              },
              {
                "name": "Handle",
                "value": "0x000005ae"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions"
              }
            ],
            "repeated": 0,
            "id": 4059
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ae"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "{fbeb8a05-beee-4442-804e-409d6c4515e9}"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}"
              }
            ],
            "repeated": 0,
            "id": 4060
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000000",
                "pretty_value": "HKEY_CLASSES_ROOT"
              },
              {
                "name": "SubKey",
                "value": "Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}"
              },
              {
                "name": "Handle",
                "value": "0x0000059e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}"
              }
            ],
            "repeated": 0,
            "id": 4061
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059e"
              },
              {
                "name": "ValueName",
                "value": "DriveMask"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask"
              }
            ],
            "repeated": 0,
            "id": 4062
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059e"
              }
            ],
            "repeated": 0,
            "id": 4063
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ae"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\"
              }
            ],
            "repeated": 0,
            "id": 4064
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005ae"
              }
            ],
            "repeated": 0,
            "id": 4065
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4066
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0df000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4067
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 4068
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4069
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 4070
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9CFC2DF3-6BA3-46EF-A836-E519E81F0EC4"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000000-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4071
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000323-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000146-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4072
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager"
              },
              {
                "name": "Handle",
                "value": "0x0000059c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager"
              }
            ],
            "repeated": 0,
            "id": 4073
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000059c"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4074
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000059c"
              }
            ],
            "repeated": 0,
            "id": 4075
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.storage.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94410000"
              }
            ],
            "repeated": 0,
            "id": 4076
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstanceEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "ServerName",
                "value": ""
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 1,
            "id": 4077
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": false,
            "return": "0xffffffffffffffff",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\\*"
              }
            ],
            "repeated": 0,
            "id": 4078
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000500"
              }
            ],
            "repeated": 1,
            "id": 4079
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.UI.Shell.TaskbarManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager"
              }
            ],
            "repeated": 0,
            "id": 4080
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005a4"
              },
              {
                "name": "KeyInformation",
                "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00>\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00h\\x00e\\x00l\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0g\\xffa1\n\\xffae\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00h(\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffcc\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff90\\xfff2\\x05\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x7f[%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10%\r\\xffbfJ\\x02\\x00\\x00h(\\x06\\xffbfJ\\x02\\x00\\x00@(\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xff90\\xfff2\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@(\\x06\\xffbfJ\\x02\\x00\\x00\\xff90\\xfff2\\x05\\xffbfJ\\x02\\x00\\x00\\x10%\r\\xffbfJ\\x02\\x00\\x00\\xffa0\\xfff0\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10%\r\\xffbfJ\\x02\\x00\\x00\\xff80\t\\x06\\xffbfJ\\x02\\x00\\x00\\xff80\t\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xfff2\\x05\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\t\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff90\\xfff2\\x05\\xffbfJ\\x02\\x00\\x00\\xffa0\\xfff0\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffcd\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0\\xffc2\\x05\\xffbfJ\\x02\\x00\\x00@(\\x06\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4081
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 4082
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 4083
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\wpnapps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 4084
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 4085
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 4086
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 4087
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 4088
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 4089
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 4090
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 4091
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4092
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4093
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              }
            ],
            "repeated": 0,
            "id": 4094
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.ApplicationModel.TaskbarPinnableSurface"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface"
              }
            ],
            "repeated": 0,
            "id": 4095
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005a4"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00p\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00T\\x00a\\x00s\\x00k\\x00b\\x00a\\x00r\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00h(\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffcc\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff806\\x0c\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00o[%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10%\r\\xffbfJ\\x02\\x00\\x00h(\\x06\\xffbfJ\\x02\\x00\\x00@(\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xff806\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00@(\\x06\\xffbfJ\\x02\\x00\\x00\\xff806\\x0c\\xffbfJ\\x02\\x00\\x00\\x10%\r\\xffbfJ\\x02\\x00\\x00\\xffa0\\xfff0\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10%\r\\xffbfJ\\x02\\x00\\x00\\xffa0\\x08\\x06\\xffbfJ\\x02\\x00\\x00\\xffa0\\x08\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff806\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\x08\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff806\\x0c\\xffbfJ\\x02\\x00\\x00\\xffa0\\xfff0\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffcd\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x05\\x06\\xffbfJ\\x02\\x00\\x00@(\\x06\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4096
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 4097
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server"
              }
            ],
            "repeated": 0,
            "id": 4098
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 4099
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading"
              }
            ],
            "repeated": 0,
            "id": 4100
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 4101
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 4102
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 4103
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 4104
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 4105
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 4106
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4107
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4108
          },
          {
            "timestamp": "2026-05-28 22:32:08,765",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a4"
              }
            ],
            "repeated": 0,
            "id": 4109
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\dxgi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94bf0000"
              }
            ],
            "repeated": 0,
            "id": 4110
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\d3d11"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92740000"
              }
            ],
            "repeated": 0,
            "id": 4111
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WININET"
              },
              {
                "name": "DllBase",
                "value": "0x7fff87a50000"
              }
            ],
            "repeated": 0,
            "id": 4112
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 26,
            "id": 4113
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\windows.internal.shell.broker"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7c210000"
              }
            ],
            "repeated": 0,
            "id": 4114
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "gdi32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98480000"
              }
            ],
            "repeated": 0,
            "id": 4115
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4116
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7c210000"
              }
            ],
            "repeated": 0,
            "id": 4117
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7c210000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\windows.internal.shell.broker.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 4118
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "windows.internal.shell.broker.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7c210000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7c251860"
              }
            ],
            "repeated": 0,
            "id": 4119
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "windows.internal.shell.broker.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7c210000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7c232a90"
              }
            ],
            "repeated": 0,
            "id": 4120
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "windows.internal.shell.broker.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7c210000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7c2303b0"
              }
            ],
            "repeated": 0,
            "id": 4121
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 4122
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 4123
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 4124
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 4125
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 4126
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 4127
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 4128
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005bc"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4129
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005bc"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4130
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4131
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4132
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4133
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4134
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c4"
              }
            ],
            "repeated": 0,
            "id": 4135
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              }
            ],
            "repeated": 0,
            "id": 4136
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005bc"
              }
            ],
            "repeated": 0,
            "id": 4137
          },
          {
            "timestamp": "2026-05-28 22:32:08,781",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005bc"
              }
            ],
            "repeated": 0,
            "id": 4138
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4139
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4140
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4141
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4142
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005cc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 4143
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4144
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4145
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}"
              },
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}"
              }
            ],
            "repeated": 0,
            "id": 4146
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d2"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 4147
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4148
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              }
            ],
            "repeated": 0,
            "id": 4149
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              }
            ],
            "repeated": 0,
            "id": 4150
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              }
            ],
            "repeated": 0,
            "id": 4151
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4152
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4153
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xab\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xa0\\xac\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4154
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 4155
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4156
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005d2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 4157
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4158
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4159
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4160
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4161
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d2"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 4162
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 4163
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4164
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4165
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 4166
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              }
            ],
            "repeated": 0,
            "id": 4167
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4168
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4169
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xaa\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x000\\xab\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4170
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 4171
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4172
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005d2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 4173
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4174
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4175
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xaa\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x000\\xab\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4176
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 4177
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4178
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005d2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 4179
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              }
            ],
            "repeated": 0,
            "id": 4180
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4181
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4182
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              }
            ],
            "repeated": 0,
            "id": 4183
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4184
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4185
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xa8\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00`\\xa9\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4186
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 4187
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4188
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005d2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 4189
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4190
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4191
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4192
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4193
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d2"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 4194
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 4195
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4196
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4197
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 4198
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              }
            ],
            "repeated": 0,
            "id": 4199
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4200
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4201
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xa6\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xf0\\xa7\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4202
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 4203
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4204
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005d2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 4205
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4206
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4207
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xa6\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x00\\xf0\\xa7\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4208
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 4209
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4210
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005d2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 4211
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d2"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 4212
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 4213
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 4214
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4215
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xa6\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xd2\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\xae\\x00\\x00\\x000\\xa7\\x95\n\\xae\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4216
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 4217
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d2"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4218
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000005d2"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 4219
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000366"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "Handle",
                "value": "0x000005d6"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              }
            ],
            "repeated": 0,
            "id": 4220
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d6"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 4221
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d6"
              }
            ],
            "repeated": 0,
            "id": 4222
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              }
            ],
            "repeated": 0,
            "id": 4223
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              },
              {
                "name": "Handle",
                "value": "0x000005d2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
              }
            ],
            "repeated": 0,
            "id": 4224
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d2"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 4225
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d2"
              }
            ],
            "repeated": 0,
            "id": 4226
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4227
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4228
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\PCShellCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d000000"
              }
            ],
            "repeated": 0,
            "id": 4229
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d000000"
              }
            ],
            "repeated": 0,
            "id": 4230
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7d000000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 4231
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "PCShellCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7d000000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7d001660"
              }
            ],
            "repeated": 0,
            "id": 4232
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "PCShellCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7d000000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4233
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "PCShellCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7d000000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7d0016a0"
              }
            ],
            "repeated": 0,
            "id": 4234
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4235
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4236
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 4237
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 4238
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 4239
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 4240
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 4241
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 4242
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 4243
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d4"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4244
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4245
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4246
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4247
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4248
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4249
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4250
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d0"
              }
            ],
            "repeated": 0,
            "id": 4251
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d4"
              }
            ],
            "repeated": 0,
            "id": 4252
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d4"
              }
            ],
            "repeated": 0,
            "id": 4253
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4254
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xc2\r\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xc3\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc3\r\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x94\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xc4\r\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xc4\r\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xb0\\xc3\r\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x006\\xc4\r\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00<\\xc4\r\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4255
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.UI.StartScreen.StartScreenManager"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager"
              }
            ],
            "repeated": 0,
            "id": 4256
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d8"
              },
              {
                "name": "KeyInformation",
                "value": "N\\xffc1\\xffec\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00U\\x00I\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00S\\x00c\\x00r\\x00e\\x00e\\x00n\\x00M\\x00a\\x00n\\x00a\\x00g\\x00e\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffe2\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc4\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00OS%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90(\r\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffe2\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe2\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe2\t\\xffbfJ\\x02\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\xff90(\r\\xffbfJ\\x02\\x00\\x00Pp\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90(\r\\xffbfJ\\x02\\x00\\x00\\xff80B\n\\xffbfJ\\x02\\x00\\x00\\xff80B\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80B\n\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00Pp\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xffc5\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00`J\n\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe2\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4257
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 4258
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server"
              }
            ],
            "repeated": 0,
            "id": 4259
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\wpnapps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 4260
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading"
              }
            ],
            "repeated": 0,
            "id": 4261
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 4262
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 4263
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 4264
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 4265
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 4266
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 4267
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4268
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4269
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4270
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000500"
              }
            ],
            "repeated": 0,
            "id": 4271
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.System.User"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User"
              }
            ],
            "repeated": 0,
            "id": 4272
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\xffd9E\\x04\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00&\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x00.\\x00U\\x00s\\x00e\\x00r\\x00\\x00\\x00\\xff88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffe9\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc4\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffa0\\xfffa\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xff8fP%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90(\r\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffe9\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe9\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffa0\\xfffa\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe9\t\\xffbfJ\\x02\\x00\\x00\\xffa0\\xfffa\t\\xffbfJ\\x02\\x00\\x00\\xff90(\r\\xffbfJ\\x02\\x00\\x00\\xffe0\\xfffb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90(\r\\xffbfJ\\x02\\x00\\x00pF\n\\xffbfJ\\x02\\x00\\x00pF\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xfffa\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pF\n\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffa0\\xfffa\t\\xffbfJ\\x02\\x00\\x00\\xffe0\\xfffb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xffc5\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00 L\n\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe9\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4273
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 4274
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "UserManager"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server"
              }
            ],
            "repeated": 0,
            "id": 4275
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 4276
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading"
              }
            ],
            "repeated": 0,
            "id": 4277
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 4278
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 4279
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 4280
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 4281
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 4282
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 4283
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x000000ea",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Type",
                "value": "0xae00000003"
              },
              {
                "name": "DataLength",
                "value": "184"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4284
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4285
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4286
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4287
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4288
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4289
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4290
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}"
              },
              {
                "name": "Handle",
                "value": "0x000005a2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}"
              }
            ],
            "repeated": 0,
            "id": 4291
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005a2"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000532"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 4292
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000532"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4293
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000532"
              }
            ],
            "repeated": 0,
            "id": 4294
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005a2"
              }
            ],
            "repeated": 0,
            "id": 4295
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4296
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4297
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4298
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4299
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}"
              },
              {
                "name": "Handle",
                "value": "0x000005de"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}"
              }
            ],
            "repeated": 0,
            "id": 4300
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005de"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000005e2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 4301
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e2"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4302
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e2"
              }
            ],
            "repeated": 0,
            "id": 4303
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005de"
              }
            ],
            "repeated": 0,
            "id": 4304
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4305
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11416",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4306
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              }
            ],
            "repeated": 0,
            "id": 4307
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}"
              },
              {
                "name": "Handle",
                "value": "0x00000532"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}"
              }
            ],
            "repeated": 0,
            "id": 4308
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000532"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 4309
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004aa"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4310
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004aa"
              }
            ],
            "repeated": 0,
            "id": 4311
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000532"
              }
            ],
            "repeated": 0,
            "id": 4312
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4313
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4314
          },
          {
            "timestamp": "2026-05-28 22:32:08,796",
            "thread_id": "8132",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000005e0"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 4315
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4316
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4317
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4318
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4319
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "99B29D3B-368A-4BE6-B675-805A69114497"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4320
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4321
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4322
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4323
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4324
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4325
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4326
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.Tiles.TileStore"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore"
              }
            ],
            "repeated": 0,
            "id": 4327
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005e4"
              },
              {
                "name": "KeyInformation",
                "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00T\\x00i\\x00l\\x00e\\x00s\\x00.\\x00T\\x00i\\x00l\\x00e\\x00S\\x00t\\x00o\\x00r\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x1e\\x00\\x00\\x00\\xffff\\x7f\\x00\\x002\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00x\\xffe9\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc4\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x10*\\x0c\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffdfP%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00x\\xffe9\t\\xffbfJ\\x02\\x00\\x00P\\xffe9\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x10*\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe9\t\\xffbfJ\\x02\\x00\\x00\\x10*\\x0c\\xffbfJ\\x02\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00\\xffe0\\xfffb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\\\x06\\xffbfJ\\x02\\x00\\x00pF\n\\xffbfJ\\x02\\x00\\x00pF\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10*\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00pF\n\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\x10*\\x0c\\xffbfJ\\x02\\x00\\x00\\xffe0\\xfffb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc5\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00P\\xffe9\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4328
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 4329
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server"
              }
            ],
            "repeated": 0,
            "id": 4330
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\TileDataRepository.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 4331
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading"
              }
            ],
            "repeated": 0,
            "id": 4332
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 4333
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005e4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 4334
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 4335
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 4336
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 4337
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 4338
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4339
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4340
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              }
            ],
            "repeated": 0,
            "id": 4341
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0f5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4342
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4343
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4344
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4345
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4346
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4347
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4348
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4349
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4350
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4351
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4352
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4353
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4354
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000042c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4355
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4356
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "Pz\\x07\\xbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4357
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c4"
              }
            ],
            "repeated": 0,
            "id": 4358
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4359
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4360
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4361
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4362
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4363
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4364
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4365
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4366
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4367
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4368
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4369
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005e4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.StateRepository.TileView"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView"
              }
            ],
            "repeated": 0,
            "id": 4370
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005e4"
              },
              {
                "name": "KeyInformation",
                "value": "\\xfffci\\x0e\\xffd4\\xffde\\xffac\\xffd5\\x01\\x00\\x00\\x00\\x00R\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00S\\x00t\\x00a\\x00t\\x00e\\x00R\\x00e\\x00p\\x00o\\x00s\\x00i\\x00t\\x00o\\x00r\\x00y\\x00.\\x00T\\x00i\\x00l\\x00e\\x00V\\x00i\\x00e\\x00w\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\xffff\\x7f\\x00\\x007\\x00\\x00\\x00\\x00\\x00\\x00\\x00.\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffeb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffbf\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00/,%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff8b\n\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffeb\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffeb\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffeb\t\\xffbfJ\\x02\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xff8b\n\\xffbfJ\\x02\\x00\\x00\\x10\\xfffe\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xff8b\n\\xffbfJ\\x02\\x00\\x00\\xffe0F\n\\xffbfJ\\x02\\x00\\x00\\xffe0F\n\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0F\n\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00P\\xffe4\t\\xffbfJ\\x02\\x00\\x00\\x10\\xfffe\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffc0\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0I\n\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffeb\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4371
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 4372
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "Data",
                "value": "StateRepository"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server"
              }
            ],
            "repeated": 0,
            "id": 4373
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0f6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4374
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 4375
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading"
              }
            ],
            "repeated": 0,
            "id": 4376
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 4377
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005e4"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 4378
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 4379
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 4380
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 4381
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 4382
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4383
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4384
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              }
            ],
            "repeated": 0,
            "id": 4385
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4386
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4387
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4388
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000003b2"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}"
              },
              {
                "name": "Handle",
                "value": "0x000005da"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}"
              }
            ],
            "repeated": 0,
            "id": 4389
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005da"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000005e6"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 4390
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e6"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 4391
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e6"
              }
            ],
            "repeated": 0,
            "id": 4392
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005da"
              }
            ],
            "repeated": 0,
            "id": 4393
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4394
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4395
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces"
              },
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces"
              }
            ],
            "repeated": 0,
            "id": 4396
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "DefaultStart"
              },
              {
                "name": "Data",
                "value": "Windows.Internal.ApplicationModel.StartPinnableSurface"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart"
              }
            ],
            "repeated": 0,
            "id": 4397
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4398
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000005d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "ApplicationService:2e381dceef1d121b644"
              }
            ],
            "repeated": 0,
            "id": 4399
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x000005d8"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb6e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95cab0"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4400
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3700000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4401
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3702000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4402
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3703000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4403
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb6e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4404
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4405
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3702000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4406
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:120:WilError_03"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4407
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4408
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4409
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4410
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4411
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4412
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e8"
              }
            ],
            "repeated": 0,
            "id": 4413
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005e4"
              }
            ],
            "repeated": 0,
            "id": 4414
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4415
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4416
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000378"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Internal.ApplicationModel.StartPinnableSurface"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface"
              }
            ],
            "repeated": 0,
            "id": 4417
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00l\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00I\\x00n\\x00t\\x00e\\x00r\\x00n\\x00a\\x00l\\x00.\\x00A\\x00p\\x00p\\x00l\\x00i\\x00c\\x00a\\x00t\\x00i\\x00o\\x00n\\x00M\\x00o\\x00d\\x00e\\x00l\\x00.\\x00S\\x00t\\x00a\\x00r\\x00t\\x00P\\x00i\\x00n\\x00n\\x00a\\x00b\\x00l\\x00e\\x00S\\x00u\\x00r\\x00f\\x00a\\x00c\\x00e\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\xfff8\\xffe6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffc3\\xff95\n\\xffae\\x00\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffe0B\\x0c\\xffbfJ\\x02\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffbfQ%\\xffa9\\xffcf\\xff86\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10c\\x0f\\xffbfJ\\x02\\x00\\x00\\xfff8\\xffe6\t\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe6\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\xffe0B\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0\\xffe6\t\\xffbfJ\\x02\\x00\\x00\\xffe0B\\x0c\\xffbfJ\\x02\\x00\\x00\\x10c\\x0f\\xffbfJ\\x02\\x00\\x00\\xffb0\\xfffe\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10c\\x0f\\xffbfJ\\x02\\x00\\x00\\xffc0\\x0e\\x06\\xffbfJ\\x02\\x00\\x00\\xffc0\\x0e\\x06\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0B\\x0c\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0e\\x06\\xffbfJ\\x02\\x00\\x00\\xff8c\\xffc2\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00J\\x02\\x00\\x00\\xffe0B\\x0c\\xffbfJ\\x02\\x00\\x00\\xffb0\\xfffe\t\\xffbfJ\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffc4\\xff95\n\\xffae\\x00\\x00\\x003\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe0\r\\x06\\xffbfJ\\x02\\x00\\x00\\xffd0\\xffe6\t\\xffbfJ\\x02\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4418
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 4419
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server"
              }
            ],
            "repeated": 0,
            "id": 4420
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\StartTileData.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 4421
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading"
              }
            ],
            "repeated": 0,
            "id": 4422
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 4423
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000005d8"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 4424
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 4425
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 4426
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 4427
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 4428
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 4429
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 4430
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005d8"
              }
            ],
            "repeated": 0,
            "id": 4431
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 4432
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Bcp47Langs"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8b3c0000"
              }
            ],
            "repeated": 0,
            "id": 4433
          },
          {
            "timestamp": "2026-05-28 22:32:08,812",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\StartTileData"
              },
              {
                "name": "DllBase",
                "value": "0x7fff81f70000"
              }
            ],
            "repeated": 0,
            "id": 4434
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\StartTileData.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff81f70000"
              }
            ],
            "repeated": 0,
            "id": 4435
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff81f70000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\StartTileData.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 4436
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "StartTileData.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff81f70000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82047f30"
              }
            ],
            "repeated": 0,
            "id": 4437
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "StartTileData.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff81f70000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82022270"
              }
            ],
            "repeated": 0,
            "id": 4438
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "StartTileData.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff81f70000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff8203a890"
              }
            ],
            "repeated": 0,
            "id": 4439
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000a"
              },
              {
                "name": "TokenHandle",
                "value": "0x000005f8"
              }
            ],
            "repeated": 0,
            "id": 4440
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005f8"
              }
            ],
            "repeated": 0,
            "id": 4441
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005f8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities"
              }
            ],
            "repeated": 0,
            "id": 4442
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000005f8"
              },
              {
                "name": "ValueName",
                "value": "shellExperience"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience"
              }
            ],
            "repeated": 0,
            "id": 4443
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xc8\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4444
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005f8"
              }
            ],
            "repeated": 0,
            "id": 4445
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005fc"
              }
            ],
            "repeated": 0,
            "id": 4446
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 4447
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 4448
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 4449
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 4450
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 4451
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 4452
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 4453
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005fc"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:11832:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4454
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005fc"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4455
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4456
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4457
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4458
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000604"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4459
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000604"
              }
            ],
            "repeated": 0,
            "id": 4460
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              }
            ],
            "repeated": 0,
            "id": 4461
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005fc"
              }
            ],
            "repeated": 0,
            "id": 4462
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005fc"
              }
            ],
            "repeated": 0,
            "id": 4463
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xdfu\\xd5\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4464
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4465
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4466
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4467
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4468
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4469
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4470
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4471
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4472
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000570"
              }
            ],
            "repeated": 0,
            "id": 4473
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c4"
              }
            ],
            "repeated": 0,
            "id": 4474
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4475
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "C2F03A33-21F5-47FA-B4BB-156362A2F239"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6D5140C1-7436-11CE-8034-00AA006009FA"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4476
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 4477
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4478
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4479
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4480
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4481
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xc2\r\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xc3\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc3\r\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x94\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xc4\r\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xc4\r\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xb0\\xc3\r\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x006\\xc4\r\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00<\\xc4\r\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4482
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000500"
              }
            ],
            "repeated": 0,
            "id": 4483
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4484
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4485
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4486
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              }
            ],
            "repeated": 0,
            "id": 4487
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4488
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4489
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4490
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4491
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "99B29D3B-368A-4BE6-B675-805A69114497"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4492
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4493
          },
          {
            "timestamp": "2026-05-28 22:32:08,828",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4494
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4495
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4496
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4497
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4498
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4499
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4500
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4501
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4502
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4503
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4504
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4505
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4506
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4507
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4508
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4509
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4510
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c0"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4511
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4512
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc03p\\xc3J\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00OP\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4513
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005f4"
              }
            ],
            "repeated": 0,
            "id": 4514
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4515
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4516
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4517
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4518
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4519
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4520
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4521
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4522
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4523
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4524
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4525
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4526
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4527
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4528
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces"
              },
              {
                "name": "Handle",
                "value": "0x00000600"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces"
              }
            ],
            "repeated": 0,
            "id": 4529
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              },
              {
                "name": "ValueName",
                "value": "DefaultStart"
              },
              {
                "name": "Data",
                "value": "Windows.Internal.ApplicationModel.StartPinnableSurface"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart"
              }
            ],
            "repeated": 0,
            "id": 4530
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              }
            ],
            "repeated": 0,
            "id": 4531
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000600"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "ApplicationService:2e381dceef1d121b644"
              }
            ],
            "repeated": 0,
            "id": 4532
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000600"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb6e0000"
              },
              {
                "name": "SectionOffset",
                "value": "0xae0a95cab0"
              },
              {
                "name": "ViewSize",
                "value": "0x00010000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4533
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac370a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4534
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac370b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4535
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24adb6e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00010000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4536
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              }
            ],
            "repeated": 0,
            "id": 4537
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac370a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4538
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000a"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000600"
              }
            ],
            "repeated": 0,
            "id": 4539
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              }
            ],
            "repeated": 0,
            "id": 4540
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000600"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "0x80000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\SecurityManager\\AdminCapabilities"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities"
              }
            ],
            "repeated": 0,
            "id": 4541
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000600"
              },
              {
                "name": "ValueName",
                "value": "shellExperience"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience"
              }
            ],
            "repeated": 0,
            "id": 4542
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xc8\\x95\n\\xae\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00 \\x02\\x00\\x00\\xd0\\x81<%\\x1e2\\x005\\xb7x)\\x13I=\\x97*\\xee\\xce'\\xd6\\x97\\xec#0mJQa\\x00\\x00\\x18\\x00\\x01\\x00\\x00\\x00\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4543
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000600"
              }
            ],
            "repeated": 0,
            "id": 4544
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000604"
              }
            ],
            "repeated": 0,
            "id": 4545
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xb5\\x9e\\xd5\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4546
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4547
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4548
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4549
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4550
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4551
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4552
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4553
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000530"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4554
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005f4"
              }
            ],
            "repeated": 0,
            "id": 4555
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00056000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4556
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x18\\xa2\\xd5\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4557
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4558
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "5000"
              }
            ],
            "repeated": 0,
            "id": 4559
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xb8\\xa2\\xd5\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4560
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x002\\xa3\\xd5\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00#\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4561
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000500"
              }
            ],
            "repeated": 5,
            "id": 4562
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemoryEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac370a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4563
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000500"
              }
            ],
            "repeated": 1,
            "id": 4564
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff965008ee",
            "parentcaller": "0x7fff970b8bd7",
            "category": "process",
            "api": "NtOpenProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000500"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00001000",
                "pretty_value": "PROCESS_QUERY_LIMITED_INFORMATION"
              },
              {
                "name": "ProcessIdentifier",
                "value": "11832"
              }
            ],
            "repeated": 0,
            "id": 4565
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff9650cbb0",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000500"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000005c4"
              }
            ],
            "repeated": 0,
            "id": 4566
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff9650aa1f",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4567
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff9650aaa8",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xc2\r\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xc3\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc3\r\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x94\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xc4\r\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xc4\r\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xb0\\xc3\r\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x006\\xc4\r\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00<\\xc4\r\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4568
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9650cbbe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c4"
              }
            ],
            "repeated": 0,
            "id": 4569
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff9650cbb0",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0x00000500"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000005c4"
              }
            ],
            "repeated": 0,
            "id": 4570
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff9650aa1f",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4571
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff9650aaa8",
            "parentcaller": "0x7fff9650cb7c",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "39"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\xc0\\xc2\r\\xbfJ\\x02\\x00\\x00\\x1c\\x00\\x1c\\x00\\x00\\x00\\x00\\x00`\\xc3\r\\xbfJ\\x02\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\xc3\r\\xbfJ\\x02\\x00\\x00\\x12\\x00\\x12\\x00\\x00\\x00\\x00\\x00\\x94\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x1e\\x00\\x1e\\x00\\x00\\x00\\x00\\x00\\xb0\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xc4\r\\xbfJ\\x02\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\xd8\\xc4\r\\xbfJ\\x02\\x00\\x00\\x02\\x00\\x00\\x00A\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf8\\xc4\r\\xbfJ\\x02\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00S\\x00Y\\x00S\\x00A\\x00P\\x00P\\x00I\\x00D\\x00\\x00\\x00\\x00\\x00\\x86\\x00\\x86\\x00\\x00\\x00\\x00\\x00\\xb0\\xc3\r\\xbfJ\\x02\\x00\\x00\\x06\\x00\\x06\\x00\\x00\\x00\\x00\\x006\\xc4\r\\xbfJ\\x02\\x00\\x00X\\x00X\\x00\\x00\\x00\\x00\\x00<\\xc4\r\\xbfJ\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4572
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff9650cbbe",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000005c4"
              }
            ],
            "repeated": 0,
            "id": 4573
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff827b9183",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000500"
              }
            ],
            "repeated": 0,
            "id": 4574
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4575
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4576
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4577
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4578
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4579
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4580
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000570"
              }
            ],
            "repeated": 0,
            "id": 4581
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12268",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c5b05",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xec/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12268"
              }
            ],
            "repeated": 0,
            "id": 4582
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4583
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "4995"
              }
            ],
            "repeated": 0,
            "id": 4584
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4585
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4586
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4587
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12232",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4588
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12232",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4589
          },
          {
            "timestamp": "2026-05-28 22:32:08,843",
            "thread_id": "12232",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4590
          },
          {
            "timestamp": "2026-05-28 22:32:08,859",
            "thread_id": "12232",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x7fff984c712f",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xc8/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12232"
              }
            ],
            "repeated": 0,
            "id": 4591
          },
          {
            "timestamp": "2026-05-28 22:32:08,859",
            "thread_id": "12268",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000570"
              }
            ],
            "repeated": 1,
            "id": 4592
          },
          {
            "timestamp": "2026-05-28 22:32:08,859",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\xc0\\xcf\\xd5\\x04\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4593
          },
          {
            "timestamp": "2026-05-28 22:32:08,859",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4594
          },
          {
            "timestamp": "2026-05-28 22:32:08,859",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "4989"
              }
            ],
            "repeated": 0,
            "id": 4595
          },
          {
            "timestamp": "2026-05-28 22:32:08,968",
            "thread_id": "11964",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "__notification__",
            "api": "__anomaly__",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadIdentifier",
                "value": "11964"
              },
              {
                "name": "Subcategory",
                "value": "unhook"
              },
              {
                "name": "FunctionName",
                "value": "CommandLineToArgvW"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff984ceb30"
              },
              {
                "name": "UnhookType",
                "value": "restored"
              }
            ],
            "repeated": 0,
            "id": 4596
          },
          {
            "timestamp": "2026-05-28 22:32:09,484",
            "thread_id": "11940",
            "caller": "0x7fff98c70880",
            "parentcaller": "0x7fff98c73008",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24abf0cc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4597
          },
          {
            "timestamp": "2026-05-28 22:32:13,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0010b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4598
          },
          {
            "timestamp": "2026-05-28 22:32:13,843",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x04\\xf8!\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00$\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00/\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 4599
          },
          {
            "timestamp": "2026-05-28 22:32:13,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4600
          },
          {
            "timestamp": "2026-05-28 22:32:13,843",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "9"
              }
            ],
            "repeated": 0,
            "id": 4601
          },
          {
            "timestamp": "2026-05-28 22:32:13,859",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x897\"\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4602
          },
          {
            "timestamp": "2026-05-28 22:32:13,859",
            "thread_id": "12204",
            "caller": "0x7fff96524448",
            "parentcaller": "0x24ac52ff766",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00071000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4603
          },
          {
            "timestamp": "2026-05-28 22:32:13,859",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00c8\"\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00%\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00+\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 4604
          },
          {
            "timestamp": "2026-05-28 22:32:13,859",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4605
          },
          {
            "timestamp": "2026-05-28 22:32:13,859",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "2690"
              }
            ],
            "repeated": 0,
            "id": 4606
          },
          {
            "timestamp": "2026-05-28 22:32:16,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00144000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4607
          },
          {
            "timestamp": "2026-05-28 22:32:16,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c0012c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4608
          },
          {
            "timestamp": "2026-05-28 22:32:16,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c00144000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4609
          },
          {
            "timestamp": "2026-05-28 22:32:16,546",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x605c000e4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 4610
          },
          {
            "timestamp": "2026-05-28 22:32:16,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4611
          },
          {
            "timestamp": "2026-05-28 22:32:16,562",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "2307"
              }
            ],
            "repeated": 0,
            "id": 4612
          },
          {
            "timestamp": "2026-05-28 22:32:18,562",
            "thread_id": "12188",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac620ee58",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4613
          },
          {
            "timestamp": "2026-05-28 22:32:18,562",
            "thread_id": "12188",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x24ac620ee58",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002cc"
              },
              {
                "name": "Milliseconds",
                "value": "10000"
              }
            ],
            "repeated": 0,
            "id": 4614
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00p\\x00\\x00\\x00\\x8a\\xbcn\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x14\\x00\\x00\\x00\\x00\\x00'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00H\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00x\\x01\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "112"
              }
            ],
            "repeated": 0,
            "id": 4615
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4616
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "13680"
              }
            ],
            "repeated": 0,
            "id": 4617
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7fff96505810",
            "parentcaller": "0x24ac60cf3bb",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000103",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00+\\xbdn\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00&\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 4618
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4619
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91f9f000"
              },
              {
                "name": "ModuleName",
                "value": "PROPSYS.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4620
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff980d0000"
              }
            ],
            "repeated": 0,
            "id": 4621
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4622
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "Milliseconds",
                "value": "13678"
              }
            ],
            "repeated": 0,
            "id": 4623
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac5ca0093",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\x05\\xc5n\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 4624
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7fff965053aa",
            "parentcaller": "0x24ac60cf4b5",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xb3\\xc5n\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00)\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00!\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 4625
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000016ac"
              },
              {
                "name": "HandleName",
                "value": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
              },
              {
                "name": "Buffer",
                "value": "\\x10\\x00\\x00\\x00@\\x00\\x00\\x00\\xe4\\xc5n\\x05\\x00\\x00\\x00\\x00\\x18\\x00\\x16\\x00\\x00\\x00\\x00\\x00*\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x15\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "64"
              }
            ],
            "repeated": 0,
            "id": 4626
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 4627
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 4628
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000328"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xac/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12204"
              }
            ],
            "repeated": 0,
            "id": 4629
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000328"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4630
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 4631
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x24ac62c9d18",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\xa3\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xac/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12204"
              }
            ],
            "repeated": 0,
            "id": 4632
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 4633
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7fff98ca467e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12204"
              }
            ],
            "repeated": 0,
            "id": 4634
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12204",
            "caller": "0x7fff98ca469e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4635
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000328"
              }
            ],
            "repeated": 0,
            "id": 4636
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 4637
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 4638
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12192",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 4639
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12192",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x24ac62c9d18",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa2\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xa0/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12192"
              }
            ],
            "repeated": 0,
            "id": 4640
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002f8"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0\\xa2\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\xa0/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12192"
              }
            ],
            "repeated": 0,
            "id": 4641
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12192",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 4642
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12192",
            "caller": "0x7fff98ca467e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12192"
              }
            ],
            "repeated": 0,
            "id": 4643
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4644
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12192",
            "caller": "0x7fff98ca469e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4645
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 4646
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4647
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4648
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 4649
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 4650
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3ce0000"
              },
              {
                "name": "RegionSize",
                "value": "0x000d6000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4651
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b4"
              }
            ],
            "repeated": 0,
            "id": 4652
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b0"
              }
            ],
            "repeated": 0,
            "id": 4653
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ad92b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x021d5000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4654
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              }
            ],
            "repeated": 0,
            "id": 4655
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 4656
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac3af0000"
              },
              {
                "name": "RegionSize",
                "value": "0x001e6000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4657
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ac"
              }
            ],
            "repeated": 0,
            "id": 4658
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a8"
              }
            ],
            "repeated": 0,
            "id": 4659
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x24ac39b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0013b000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4660
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 4661
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 4662
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "UnregisterTraceGuids"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0340"
              }
            ],
            "repeated": 0,
            "id": 4663
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              }
            ],
            "repeated": 0,
            "id": 4664
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12176",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              }
            ],
            "repeated": 0,
            "id": 4665
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12176",
            "caller": "0x7fff9653ebae",
            "parentcaller": "0x24ac62c9d18",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\xa2\n\\xae\\x00\\x00\\x008.\\x00\\x00\\x00\\x00\\x00\\x00\\x90/\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12176"
              }
            ],
            "repeated": 0,
            "id": 4666
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12176",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 4667
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12176",
            "caller": "0x7fff98ca467e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12176"
              }
            ],
            "repeated": 0,
            "id": 4668
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "12176",
            "caller": "0x7fff98ca469e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4669
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb649",
            "parentcaller": "0x7ff61f094f22",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              }
            ],
            "repeated": 0,
            "id": 4670
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 4671
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000264"
              }
            ],
            "repeated": 0,
            "id": 4672
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61eff4c88",
            "parentcaller": "0x7ff61efdb649",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 4673
          },
          {
            "timestamp": "2026-05-28 22:32:18,875",
            "thread_id": "11836",
            "caller": "0x7ff61efdb65c",
            "parentcaller": "0x7ff61f094f22",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4674
          }
        ],
        "threads": [
          "11836",
          "11976",
          "11972",
          "11968",
          "11964",
          "12168",
          "12176",
          "12184",
          "12188",
          "12192",
          "12196",
          "12200",
          "12204",
          "12232",
          "12256",
          "12260",
          "12264",
          "12268",
          "11416",
          "8132",
          "11940"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff61efc0000",
          "MainExeSize": "0x0028c000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 3704,
        "process_name": "dllhost.exe",
        "parent_id": 840,
        "module_path": "C:\\Windows\\System32\\dllhost.exe",
        "first_seen": "2026-05-28 22:32:53,001",
        "calls": [
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff7bdf514e0"
              },
              {
                "name": "Parameter",
                "value": "0x9288147000"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "8612",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c677c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 3,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3664",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3664",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71a00"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf512f2",
            "parentcaller": "0x7ff7bdf513bb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de5f8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf512f2",
            "parentcaller": "0x7ff7bdf513bb",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de5f9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51349",
            "parentcaller": "0x7ff7bdf513dc",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff7bdf51b60"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "8612",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "8612",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71ed0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3796",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de5fb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000206"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3796",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3796",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f72030"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3764",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3764",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71e10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "42"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "3808"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000208"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000208"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9421f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:32:53,094",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000208"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94213f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000208"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000208"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00082000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000208"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000228"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000228"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000228"
              }
            ],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000228"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000228"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000022c"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000228"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000228"
              }
            ],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000021c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000021c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "\\xf0\\xa6+\\x1f\\x96\\xdb,\\x08W\\xf5\\xf0V\\xa8\\x91\\xda\\xdd\\xddwz\\xe9\\xe4#\\xe6\\x06\\xda\\x18F\"\\xd4&t\\xb2 \\xf4e\\x14vr\\x89]\\x16\\xbe\\x99\\x1dw\\xddg\\xdb"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96c58b60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51153",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de600000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CLSIDFromOle1Class"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9709f760"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xf2\\xfd\\x87\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xb0\\xf2\\xfd\\x87\\x92\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000244"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:3704:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000240"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\__ComCatalogCache__"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000240"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266e13b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9287fdf2d0"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de606000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\COM3"
              },
              {
                "name": "Handle",
                "value": "0x00000248"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              },
              {
                "name": "ValueName",
                "value": "Com+Enabled"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000248"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "clbcatq.dll"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000248"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98230000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000a9000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982d4000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a9000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a8000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff982a8000"
              },
              {
                "name": "ModuleName",
                "value": "clbcatq.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000024c"
              },
              {
                "name": "EventName",
                "value": "\\KernelObjects\\MaximumCommitCondition"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\clbcatq"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98230000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff9824d990"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000250"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000004"
              },
              {
                "name": "ObjectAttributes",
                "value": "Global\\__ComCatalogCache__"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000250"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266e13c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x9287fdf020"
              },
              {
                "name": "ViewSize",
                "value": "0x00001000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000256"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Delivery Optimization User"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "LocalService"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalService"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "DllSurrogate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "DllSurrogate"
              },
              {
                "name": "Data",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "RunAs"
              },
              {
                "name": "Data",
                "value": "Interactive User"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RunAs"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "ActivateAtStorage"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateAtStorage"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x0000025a"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025a"
              },
              {
                "name": "ValueName",
                "value": "ROTFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ROTFlags"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025a"
              },
              {
                "name": "ValueName",
                "value": "AppIDFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppIDFlags"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025a"
              },
              {
                "name": "ValueName",
                "value": "MGOTFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\MGOTFlags"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025a"
              },
              {
                "name": "ValueName",
                "value": "ProcessMitigationPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProcessMitigationPolicy"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000025a"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "LaunchPermission"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "LaunchPermission"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x04\\x80`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00L\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x00000258"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              },
              {
                "name": "ValueName",
                "value": "LegacyAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              },
              {
                "name": "ValueName",
                "value": "LegacyImpersonationLevel"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "AuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "RemoteServerName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RemoteServerName"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "SRPTrustLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\SRPTrustLevel"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "PreferredServerBitness"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\PreferredServerBitness"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "LoadUserSettings"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LoadUserSettings"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xeb\\xfd\\x87\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00V\\x02\\x00\\x00\\x00\\x00\\x00\\x00PQ/\\x97\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000258"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000258"
              },
              {
                "name": "SubKey",
                "value": "Software\\Classes"
              },
              {
                "name": "Handle",
                "value": "0x0000025c"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegNotifyChangeKeyValue",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\"
              },
              {
                "name": "NotifyFilter",
                "value": "0x10000005"
              },
              {
                "name": "WatchSubtree",
                "value": "1"
              },
              {
                "name": "Asynchronous",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              },
              {
                "name": "ValueName",
                "value": "ProtectionLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProtectionLevel"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000256"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de607000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000260"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000260"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000260"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000260"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de609000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x00000260"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "20"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "18"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10\\xea\\xfd\\x87\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00'\\xc0\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xbd\\x15S\\xff\\x7f\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xc0\\xea\\xfd\\x87\\x92\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000264"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\User\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000260"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000266"
              },
              {
                "name": "SubKey",
                "value": "AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x00000262"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000262"
              },
              {
                "name": "ValueName",
                "value": "AuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x00000268"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              },
              {
                "name": "ValueName",
                "value": "RaiseDefaultAuthnLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000262"
              },
              {
                "name": "ValueName",
                "value": "AccessPermission"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x04\\x80\\\\x00\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00H\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AccessPermission"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000262"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xef\\xfd\\x87\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xa6CP\\x96\\xff\\x7f\\x00\\x00]pG\\xc7\\xac-\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000268"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000e78"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.COM.DISABLE.3704"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.IEC.STATUS.6c736db0"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de60b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000266"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{00000134-0000-0000-C000-000000000046}"
              },
              {
                "name": "Handle",
                "value": "0x00000276"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000276"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000027a"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027a"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027a"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000276"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000274"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\Rpc\\Extensions"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000274"
              },
              {
                "name": "ValueName",
                "value": "NdrOleExtDLL"
              },
              {
                "name": "Type",
                "value": "2",
                "pretty_value": "REG_EXPAND_SZ"
              },
              {
                "name": "Information",
                "value": "combase.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "NdrOleInitializeExtension"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970c4240"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9706b0b0"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97068b50"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "StringFromIID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97099780"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemAlloc"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970a2e80"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970a1b70"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateInstance"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701a420"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701e790"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000278"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8/_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p6_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H2_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00-GG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x80\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00x\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00H\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00h\\xe5\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@2_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00h\\xe3\\xfd\\x87\\x92\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "h0_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "04_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe84_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00MCG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xe0\\xe1\\xfd\\x87\\x92\\x00\\x00\\x00\\xd8\\xe1\\xfd\\x87\\x92\\x00\\x00\\x00\\xa8\\xe1\\xfd\\x87\\x92\\x00\\x00\\x00\\xc8\\xe1\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe04_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xc8\\xdf\\xfd\\x87\\x92\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000278"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de60d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:32:53,110",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000284"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f8dc0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "9108"
              },
              {
                "name": "ProcessId",
                "value": "3704"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000284",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f8dc0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "9108"
              },
              {
                "name": "ProcessId",
                "value": "3704"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x887_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P2_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8\\`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe84_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xfdzG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00P\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00H\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00\\x18\\xe9\\xfd\\x87\\x92\\x00\\x00\\x008\\xe9\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe04_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe7\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x086_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p6_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8[`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe87_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x1dGG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\xa8\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00x\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\xe5\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe07_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H2_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf07_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8Y`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe84_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xfdzG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00P\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00H\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00\\x18\\xe9\\xfd\\x87\\x92\\x00\\x00\\x008\\xe9\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe04_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe7\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x086_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00w\\x00s\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p6_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8Y`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x887_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x1dGG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\xa8\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00x\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\xe5\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x807_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H2_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p6_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8Y`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x887_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xfdzG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00P\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00H\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00\\x18\\xe9\\xfd\\x87\\x92\\x00\\x00\\x008\\xe9\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x807_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe7\\xfd\\x87\\x92\\x00\\x00\\x00\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe84_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x106_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00.\\x00d\\x00l\\x00l\\x00"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8Y`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe87_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x1dGG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\xa8\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00x\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\xe5\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe07_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\\xfd\\x87\\x92\\x00\\x00\\x00\\x04\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x887_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf04_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "H]`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x089_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xfdzG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00P\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00H\\xe9\\xfd\\x87\\x92\\x00\\x00\\x00\\x18\\xe9\\xfd\\x87\\x92\\x00\\x00\\x008\\xe9\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x009_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x008\\xe7\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x086_\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x000\\x00\\x00\\\\x00S\\x00Y\\x00S\\x00T\\x00E\\x00M\\x003\\x002\\x00\\\\x00k\\x00e\\x00r\\x00n\\x00e\\x00l\\x00.\\x00a\\x00p\\x00p\\x00c\\x00o\\x00r\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "P2_\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8Y`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "h6_\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x1dGG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\xa8\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00x\\xe5\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\xe5\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`6_\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xe3\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de60f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "9112",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "9112",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x266de5d0b50"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "9112",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de611000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "9112",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x0000029c"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "9112",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de612000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "1164",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "1164",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x266de5d0b50"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "1164",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de614000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000298"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f88c0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "8964"
              },
              {
                "name": "ProcessId",
                "value": "3704"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000298",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f88c0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8964"
              },
              {
                "name": "ProcessId",
                "value": "3704"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f88c0"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97d82b57",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\uxtheme"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97d82b57",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\uxtheme.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93cf0000"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97d82b57",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff93cf0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\uxtheme.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000008"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97d82bbb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "uxtheme.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff93cf0000"
              },
              {
                "name": "FunctionName",
                "value": "ThemeInitApiHook"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff93cfcde0"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff93cfce20",
            "parentcaller": "0x7fff97d82d8c",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff98c667b5",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xe9\\xcf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c667ec",
            "parentcaller": "0x7fff964e5140",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000298"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002b8"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000298"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff96502fe4",
            "parentcaller": "0x7fff93d2d921",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "ValueName",
                "value": "AppsUseLightTheme"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme"
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff96503018",
            "parentcaller": "0x7fff93d2d921",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff93cfd96c",
            "parentcaller": "0x7fff93cfd1d1",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000298"
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x000002bc"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000218"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002c0"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8^a\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10Wa\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8Y`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "(aa\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xcdxu\\xc8\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xeb\\xcf\\x88\\x92\\x00\\x00\\x00X\\xeb\\xcf\\x88\\x92\\x00\\x00\\x00(\\xeb\\xcf\\x88\\x92\\x00\\x00\\x00H\\xeb\\xcf\\x88"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 aa\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe9\\xcf\\x88\\x92\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H_a\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "PVa\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8Y`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8`a\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00mEu\\xc8\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xc0\\xe7\\xcf\\x88\\x92\\x00\\x00\\x00\\xb8\\xe7\\xcf\\x88\\x92\\x00\\x00\\x00\\x88\\xe7\\xcf\\x88\\x92\\x00\\x00\\x00\\xa8\\xe7\\xcf\\x88"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0`a\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xe5\\xcf\\x88\\x92\\x00\\x00\\x00\\xc0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000218"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c0"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "8964",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de617000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "H\\a\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0Va\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf8[`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8_a\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\rDG\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xe6\\xfd\\x87\\x92\\x00\\x00\\x00\\x98\\xe6\\xfd\\x87\\x92\\x00\\x00\\x00h\\xe6\\xfd\\x87\\x92\\x00\\x00\\x00\\x88\\xe6\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0_a\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe4\\xfd\\x87\\x92\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8[a\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10Wa\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "HZ`\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08ca\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xad@G\\xc7\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x00\\xe3\\xfd\\x87\\x92\\x00\\x00\\x00\\xf8\\xe2\\xfd\\x87\\x92\\x00\\x00\\x00\\xc8\\xe2\\xfd\\x87\\x92\\x00\\x00\\x00\\xe8\\xe2\\xfd\\x87"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00ca\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xe8\\xe0\\xfd\\x87\\x92\\x00\\x00\\x00t\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:32:53,126",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000274"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff970d7db0"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f79b0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "8844"
              },
              {
                "name": "ProcessId",
                "value": "3704"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000274",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff970d7db0"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f79b0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "8844"
              },
              {
                "name": "ProcessId",
                "value": "3704"
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              },
              {
                "name": "Milliseconds",
                "value": "20000"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "8844",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "8844",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff970d7db0"
              },
              {
                "name": "Parameter",
                "value": "0x266de5f79b0"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "8844",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970d7dc9",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "8844",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970d7dc9",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000230"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "8844",
            "caller": "0x7fff98ca467e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "8844"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "8844",
            "caller": "0x7fff98ca469e",
            "parentcaller": "0x7fff98b6734d",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000218"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de619000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe4\\x8b\\x0b\\x00\\x00\\x00\\x00\\x00\\xe4\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\n\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xe9k\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000274"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9709d427",
            "parentcaller": "0x7fff97013d82",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x266de5d2148",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de61b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c42bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9706b0b0"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c42e9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97068b50"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c4313",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "StringFromIID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97099780"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c433d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemAlloc"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970a2e80"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c4367",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970a1b70"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c4391",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateInstance"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701a420"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c43bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701e790"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970c41cf",
            "parentcaller": "0x7fff98c938c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff9704b0ca",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xc7\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x00\\xc8\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ca"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Delivery Optimization User Class"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ca"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96524aa9",
            "parentcaller": "0x7fff965031c6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\system32\\domgmt.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xc5\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x90\\xc6\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ca"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90\\xc5\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\x90\\xc6\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ca"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970994b2",
            "parentcaller": "0x7fff970854b4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x000002c8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970994ea",
            "parentcaller": "0x7fff970854b4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              },
              {
                "name": "ValueName",
                "value": "MaxSxSHashCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount"
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97099503",
            "parentcaller": "0x7fff970854b4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002c8"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xc5\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\xa0\\xc6\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ca"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Delivery Optimization User Class"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ca"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96524aa9",
            "parentcaller": "0x7fff965031c6",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "%SystemRoot%\\system32\\domgmt.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 1,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xc4\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x000\\xc5\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ca"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "0\\xc4\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x000\\xc5\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ca"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ca"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "Data",
                "value": "{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970c5483",
            "parentcaller": "0x7fff97044bdc",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97044c07",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ce"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Delivery Optimization User"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "LocalService"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalService"
              }
            ],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "DllSurrogate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "DllSurrogate"
              },
              {
                "name": "Data",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97029bff",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "RunAs"
              },
              {
                "name": "Data",
                "value": "Interactive User"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RunAs"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97029d1a",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "ActivateAtStorage"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateAtStorage"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97029e39",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x000002d2"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97029e8d",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d2"
              },
              {
                "name": "ValueName",
                "value": "ROTFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ROTFlags"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97029ee0",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d2"
              },
              {
                "name": "ValueName",
                "value": "AppIDFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppIDFlags"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97029f30",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d2"
              },
              {
                "name": "ValueName",
                "value": "MGOTFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\MGOTFlags"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97029f84",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d2"
              },
              {
                "name": "ValueName",
                "value": "ProcessMitigationPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProcessMitigationPolicy"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97029fa7",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d2"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970b9058",
            "parentcaller": "0x7fff97029fcb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "LaunchPermission"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970b90d0",
            "parentcaller": "0x7fff97029fcb",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "LaunchPermission"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x04\\x80`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00L\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a010",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a052",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "ValueName",
                "value": "LegacyAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a0a5",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              },
              {
                "name": "ValueName",
                "value": "LegacyImpersonationLevel"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a0de",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d0"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a123",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "AuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "RemoteServerName"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RemoteServerName"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a1c8",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "SRPTrustLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\SRPTrustLevel"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a227",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "PreferredServerBitness"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\PreferredServerBitness"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a28a",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "LoadUserSettings"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LoadUserSettings"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702a318",
            "parentcaller": "0x7fff97044dd5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "ValueName",
                "value": "ProtectionLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProtectionLevel"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97044e2a",
            "parentcaller": "0x7fff9702a9ba",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970c450c",
            "parentcaller": "0x7fff9702aa90",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ca"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970c4529",
            "parentcaller": "0x7fff9702aa90",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff964fddf0",
            "parentcaller": "0x7fff970c4a29",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff964fde10",
            "parentcaller": "0x7fff970c4a29",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              }
            ],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "p\\xc3\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00\\xca\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00p\\xc4\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002ca"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002ca"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x000002ce"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702ad4d",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ce"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ce"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000266"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              },
              {
                "name": "Handle",
                "value": "0x000002ca"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff9709f8f8",
            "parentcaller": "0x7fff9702213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ca"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff97022160",
            "parentcaller": "0x7fff97019277",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ca"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\logoncli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95800000"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95850000"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dhcpcsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8eab0000"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\WINHTTP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90780000"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:32:53,141",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 9,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95450000"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\IPHLPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff956f0000"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96260000"
              }
            ],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91e70000"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\DNSAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95730000"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 2,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98cb7cc6",
            "parentcaller": "0x7fff98c8ddf7",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\domgmt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a0b0000"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96565db3",
            "parentcaller": "0x7fff956f8adc",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96565db3",
            "parentcaller": "0x7fff956f8adc",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\NSI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98020000"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\domgmt.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3a0b0000"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff3a0b0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\system32\\domgmt.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "domgmt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff3a0b0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff3a0be9d0"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "domgmt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff3a0b0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "domgmt.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff3a0b0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff3a0beb40"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff97030e64",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030e82",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoGetMarshalSizeMax"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9705c590"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030e9f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9706b0b0"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030ebc",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97068b50"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030ed9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701e790"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000266"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}"
              },
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000342"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xb8\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00`\\xb9\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000342"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000342"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xb6\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\xf0\\xb7\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000342"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xb6\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\xf0\\xb7\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000342"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": " \\xb5\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00 \\xb6\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000342"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "PSFactoryBuffer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000342"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xb3\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\xb0\\xb4\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000342"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0\\xb3\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\xb0\\xb4\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000342"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000342"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965045a7",
            "parentcaller": "0x7fff96500705",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff96502314",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff98c86c8b",
            "parentcaller": "0x7fff965023a0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "\\xf0\\xb2\\xbf\\x88\\x92\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\xe9\\x03\\x00\\x00\\xff\\x7f\\x00\\x00\\xb8\\xcf\\x15S\\xff\\x7f\\x00\\x00B\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\xe0\\xd2\\x15S\\xff\\x7f\\x00\\x00\\x04\\x00\\x00\\x00\\x92\\x00\\x00\\x00\\xf0\\xb3\\xbf\\x88\\x92\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965024a8",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-21-3968686040-3210279463-847977608-1001_Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff965025c4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000342"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965025e2",
            "parentcaller": "0x7fff96500732",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000342"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000246"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "Handle",
                "value": "0x0000033e"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9702ad4d",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000033e"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033e"
              }
            ],
            "repeated": 0,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000266"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              },
              {
                "name": "Handle",
                "value": "0x00000342"
              },
              {
                "name": "FullName",
                "value": "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9709f8f8",
            "parentcaller": "0x7fff9702213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000342"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff97022160",
            "parentcaller": "0x7fff97019277",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000342"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000258"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff874d0000"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff874d0000"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff874d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff874d0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff874d3830"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff874d0000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:32:53,157",
            "thread_id": "1164",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "OneCoreCommonProxyStub.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff874d0000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff874d3890"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000340"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8Ya\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90aa\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "X\\x0cb\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08Za\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x1d$\\x05\\xc8\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xc6\\xbf\\x88\\x92\\x00\\x00\\x00\\xa8\\xc6\\xbf\\x88\\x92\\x00\\x00\\x00x\\xc6\\xbf\\x88\\x92\\x00\\x00\\x00\\x98\\xc6\\xbf\\x88"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Za\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xc4\\xbf\\x88\\x92\\x00\\x00\\x00D\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\x97p\\x0b\\x00\\x00\\x00\\x00\\x00Pq\\x02\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\xff\\x7f\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x94\\x0f\\x00\\x00\\x0e\\x00\\x00\\x00\\x18\\x00\\x00\\x00qq\\x02\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "hZa\\xdef\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x10]a\\xdef\\x02\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x13b\\xdef\\x02\\x00\\x00\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x05\\x15\\x00\\x00\\x00\\xd8W\\x8d\\xec'\\xfaX\\xbf\\x88\\x1c\\x8b2\\x01\\x02\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8aa\\xdef\\x02\\x00\\x00\\x02\\x00P\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x00\\x00\\x00\\x10\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x1c\\x00\\x00\\x00\\x00\\xa0\\x01\\x03\\x00\\x00\\x00\\x00\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x91p\\x02\\x00"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xbd \\x05\\xc8\\xac-\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x10\\xc3\\xbf\\x88\\x92\\x00\\x00\\x00\\x08\\xc3\\xbf\\x88\\x92\\x00\\x00\\x00\\xd8\\xc2\\xbf\\x88\\x92\\x00\\x00\\x00\\xf8\\xc2\\xbf\\x88"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe0aa\\xdef\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xc0\\xbf\\x88\\x92\\x00\\x00\\x00D\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de625000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3a132000"
              },
              {
                "name": "ModuleName",
                "value": "domgmt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3a132000"
              },
              {
                "name": "ModuleName",
                "value": "domgmt.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c867b9",
            "parentcaller": "0x7fff9653ced6",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff3a0be2ec",
            "parentcaller": "0x7fff96d2b583",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "5B99FA76-721C-423C-ADAC-56D03C8A8007"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "6692FD56-3B9B-433A-AC04-3FFB442556DD"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff96cf1630",
            "parentcaller": "0x7fff96cf12cd",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "1164",
            "caller": "0x7fff96cb7be3",
            "parentcaller": "0x7fff96cf15ab",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:32:53,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf5116a",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000234"
              },
              {
                "name": "Milliseconds",
                "value": "5000"
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "windows",
            "api": "PostThreadMessageW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ProcessId",
                "value": "3704"
              },
              {
                "name": "ThreadId",
                "value": "8964"
              },
              {
                "name": "Message",
                "value": "1033"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff9701ea0e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff980d0000"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000200"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000022c"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000228"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97092ec5",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff9701cd6e",
            "parentcaller": "0x7fff97092ed4",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97094324",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000001f4"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff98ca467e",
            "parentcaller": "0x7fff9654f79a",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "8964"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff985815b8",
            "parentcaller": "0x7fff98c69a1d",
            "category": "misc",
            "api": "GetKeyboardLayout",
            "status": true,
            "return": "0x04090409",
            "arguments": [
              {
                "name": "KeyboardLayout",
                "value": "0x00000409"
              },
              {
                "name": "LanguageName",
                "value": "English (United States)"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96d0e41e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002bc"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96d0e4e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtDelayExecution",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "8964",
            "caller": "0x7fff98ca469e",
            "parentcaller": "0x7fff9654f79a",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000254"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de600000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266de60a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "1164",
            "caller": "0x7fff96cfbf07",
            "parentcaller": "0x7fff96cfbe66",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "1164",
            "caller": "0x7fff96cb5bc1",
            "parentcaller": "0x7fff96cb5b34",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSectionEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x266e13b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000246"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\OneCoreCommonProxyStub"
              },
              {
                "name": "DllBase",
                "value": "0x7fff874d0000"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff874d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000240"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\domgmt"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a0b0000"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e4"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002cc"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\logoncli"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95800000"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95800000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\netutils"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95850000"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95850000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e8"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\dhcpcsvc"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8eab0000"
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8eab0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\WINHTTP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90780000"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90780000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f8"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000300"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000304"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000308"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000030c"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\ntmarta"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95450000"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95450000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000310"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\shcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff984b0000"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff984b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000318"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\USERENV"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96220000"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96220000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\profapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96260000"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96260000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\XmlLite"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91e70000"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91e70000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000328"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000324"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000320"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000031c"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\DNSAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95730000"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000314"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\IPHLPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff956f0000"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\NSI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98020000"
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98020000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff956f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95730000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtUnmapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3a0b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51176",
            "parentcaller": "0x7ff7bdf51466",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "oleaut32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff980d0000"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:32:58,172",
            "thread_id": "3808",
            "caller": "0x7ff7bdf51193",
            "parentcaller": "0x7ff7bdf51466",
            "category": "process",
            "api": "NtTerminateProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "ExitCode",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 792
          }
        ],
        "threads": [
          "3808",
          "8612",
          "3664",
          "3796",
          "3764",
          "9112",
          "1164",
          "8964",
          "8844"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff7bdf50000",
          "MainExeSize": "0x00009000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 8032,
        "process_name": "mousocoreworker.exe",
        "parent_id": 840,
        "module_path": "C:\\Windows\\System32\\mousocoreworker.exe",
        "first_seen": "2026-05-28 22:32:53,700",
        "calls": [
          {
            "timestamp": "2026-05-28 22:32:53,793",
            "thread_id": "4572",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dmiso8601utils"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff81550000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff81551380"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 0
          },
          {
            "timestamp": "2026-05-28 22:32:53,793",
            "thread_id": "4572",
            "caller": "0x7fff98d0e53f",
            "parentcaller": "0x7fff98c6faf7",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 1
          },
          {
            "timestamp": "2026-05-28 22:32:53,793",
            "thread_id": "4572",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\umpdc"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96170000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96173e30"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 2
          },
          {
            "timestamp": "2026-05-28 22:32:53,793",
            "thread_id": "4572",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff961b0000"
              },
              {
                "name": "ModuleName",
                "value": "powrprof.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3
          },
          {
            "timestamp": "2026-05-28 22:32:53,793",
            "thread_id": "4572",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff961b0000"
              },
              {
                "name": "ModuleName",
                "value": "powrprof.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4
          },
          {
            "timestamp": "2026-05-28 22:32:53,793",
            "thread_id": "4572",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\powrprof"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96190000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96193480"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 5
          },
          {
            "timestamp": "2026-05-28 22:32:53,793",
            "thread_id": "4572",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\profapi"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96260000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff962690e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 6
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff8e438cd5",
            "parentcaller": "0x7fff8e43a046",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Compression"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression"
              }
            ],
            "repeated": 0,
            "id": 7
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff8e438cd5",
            "parentcaller": "0x7fff8e43a046",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\cabinet"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e430000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8e439320"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 8
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\userenv"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96220000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96224f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 9
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff873dbad9",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 10
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff873dbb0c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "InitializeConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb9f40"
              }
            ],
            "repeated": 0,
            "id": 11
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff873dbb20",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "SleepConditionVariableCS"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96543890"
              }
            ],
            "repeated": 0,
            "id": 12
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff873dbb34",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "WakeAllConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca5430"
              }
            ],
            "repeated": 0,
            "id": 13
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff873dbb34",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\updatepolicy"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff873b0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff873da8e0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 14
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\imagehlp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98560000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff985623b0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 15
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\tbs"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e460000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8e465fa0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 16
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff826aae69",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 17
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff826aae9c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "InitializeConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb9f40"
              }
            ],
            "repeated": 0,
            "id": 18
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff826aaeb0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "SleepConditionVariableCS"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96543890"
              }
            ],
            "repeated": 0,
            "id": 19
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff826aaec4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "WakeAllConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca5430"
              }
            ],
            "repeated": 0,
            "id": 20
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead8f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 21
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff96524f76",
            "parentcaller": "0x7fff82661662",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 22
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff8266168b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92e80"
              }
            ],
            "repeated": 0,
            "id": 23
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff826616aa",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0390"
              }
            ],
            "repeated": 0,
            "id": 24
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff826616c9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d10"
              }
            ],
            "repeated": 0,
            "id": 25
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff826616e8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c9f1b0"
              }
            ],
            "repeated": 0,
            "id": 26
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead92000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 27
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead94000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 28
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead95000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 29
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead97000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 30
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead99000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 31
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead9a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 32
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead9c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 33
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead9e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 34
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cead9f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 35
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dmcmnutils"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82660000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff826a9b00"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 36
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff96af5d32",
            "parentcaller": "0x7fff96b03fdd",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000260"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80000000",
                "pretty_value": "GENERIC_READ"
              },
              {
                "name": "FileName",
                "value": "\\Device\\DeviceApi\\CMApi"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "0"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000000"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 37
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff96af5d32",
            "parentcaller": "0x7fff96b03fdd",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\cfgmgr32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96af0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96b03750"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 38
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98cbc2c7",
            "parentcaller": "0x7fff98cbc05a",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\xmllite"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91e70000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff91e7f5a0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 39
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8c905f32",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 40
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8c905f32",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-synch-l1-2-0"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 41
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff8c905fc9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "InitializeCriticalSectionEx"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9653be60"
              }
            ],
            "repeated": 0,
            "id": 42
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8c905f32",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 43
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff8c905f32",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff964d0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-core-fibers-l1-1-1"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 44
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff8c905fc9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsAlloc"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9654ac60"
              }
            ],
            "repeated": 0,
            "id": 45
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff8c905fc9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsSetValue"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9651b6d0"
              }
            ],
            "repeated": 0,
            "id": 46
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff8c905fc9",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\winsqlite3"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8c860000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff8c904140"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 47
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 48
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "4572",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff6d48cf900"
              },
              {
                "name": "Parameter",
                "value": "0x3fa3e8e000"
              }
            ],
            "repeated": 0,
            "id": 49
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12420",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff8c905fc9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsGetValue"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96520fa0"
              }
            ],
            "repeated": 0,
            "id": 50
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12420",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 51
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12420",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71ed0"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 52
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12416",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceace2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "yes"
              }
            ],
            "repeated": 0,
            "id": 53
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12416",
            "caller": "0x7fff98caeb32",
            "parentcaller": "0x7fff98c677c3",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000038"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 54
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12412",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 55
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12412",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71e10"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 56
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12416",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 57
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12416",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f72030"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 58
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12408",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceada1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 59
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12408",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 60
          },
          {
            "timestamp": "2026-05-28 22:32:53,809",
            "thread_id": "12408",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff52f71a00"
              },
              {
                "name": "Parameter",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 61
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d1219",
            "parentcaller": "0x7ff6d48cf7db",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 62
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d124c",
            "parentcaller": "0x7ff6d48cf7db",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "InitializeConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb9f40"
              }
            ],
            "repeated": 0,
            "id": 63
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d1260",
            "parentcaller": "0x7ff6d48cf7db",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "SleepConditionVariableCS"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96543890"
              }
            ],
            "repeated": 0,
            "id": 64
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d1274",
            "parentcaller": "0x7ff6d48cf7db",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "WakeAllConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca5430"
              }
            ],
            "repeated": 0,
            "id": 65
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48cf769",
            "parentcaller": "0x7ff6d48cf7fc",
            "category": "hooking",
            "api": "SetUnhandledExceptionFilter",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ExceptionFilter",
                "value": "0x7ff6d48d0410"
              }
            ],
            "repeated": 0,
            "id": 66
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47c56e0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceada2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 67
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceada4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 68
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd102",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceada5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 69
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceada9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 70
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadaa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 71
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadab000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 72
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 73
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47c54fd",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadad000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 74
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadaf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 75
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47c54b2",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadb2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 76
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x18ceadb2a20"
              }
            ],
            "repeated": 0,
            "id": 77
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 78
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 79
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 80
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 81
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000026c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 82
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000026c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\kernel.appcore.dll"
              }
            ],
            "repeated": 0,
            "id": 83
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00012000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 84
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9421f000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 85
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 86
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 87
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 88
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 89
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 90
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 91
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000026c"
              }
            ],
            "repeated": 0,
            "id": 92
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94215000"
              },
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 93
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\kernel.appcore"
              },
              {
                "name": "DllBase",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 94
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\kernel.appcore"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff94213f10"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 95
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 96
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 97
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 98
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtOpenSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "bcryptPrimitives.dll"
              }
            ],
            "repeated": 0,
            "id": 99
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000270"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00082000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 100
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 101
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 102
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 103
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 104
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 105
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000270"
              }
            ],
            "repeated": 0,
            "id": 106
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c87000"
              },
              {
                "name": "ModuleName",
                "value": "bcryptPrimitives.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 107
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\bcryptPrimitives"
              },
              {
                "name": "DllBase",
                "value": "0x7fff96c20000"
              }
            ],
            "repeated": 0,
            "id": 108
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 109
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "ValueName",
                "value": "STE"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE"
              }
            ],
            "repeated": 0,
            "id": 110
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 111
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 112
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "ValueName",
                "value": "Enabled"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled"
              }
            ],
            "repeated": 0,
            "id": 113
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa"
              }
            ],
            "repeated": 0,
            "id": 114
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000020c"
              },
              {
                "name": "ValueName",
                "value": "FipsAlgorithmPolicy"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy"
              }
            ],
            "repeated": 0,
            "id": 115
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000210"
              },
              {
                "name": "ValueName",
                "value": "MDMEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled"
              }
            ],
            "repeated": 0,
            "id": 116
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000210"
              }
            ],
            "repeated": 0,
            "id": 117
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000020c"
              }
            ],
            "repeated": 0,
            "id": 118
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration"
              }
            ],
            "repeated": 0,
            "id": 119
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000020c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100001",
                "pretty_value": "FILE_READ_ACCESS|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "\\Device\\CNG"
              },
              {
                "name": "ShareAccess",
                "value": "7",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 120
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "device",
            "api": "DeviceIoControl",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DeviceHandle",
                "value": "0x0000020c"
              },
              {
                "name": "IoControlCode",
                "value": "0x00390008",
                "pretty_value": "IOCTL_KSEC_RANDOM_FILL_BUFFER"
              },
              {
                "name": "InBuffer",
                "value": ""
              },
              {
                "name": "OutBuffer",
                "value": "2\\xa7\\x16\"\\xa8\\xa7+\\xab\\xe2\\xc9\\xd5\\x12/\\xccG<;\\xa6\\x177qJP\\um,\\xce\"2l\\xde\\x02\\x11\\xe8\\x00\\xde\\x1c\\x7f\\xd00\\xae&\\xc5x\\x08\\xe6J"
              }
            ],
            "repeated": 0,
            "id": 121
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\bcryptprimitives"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96c20000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff96c58b60"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 122
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 123
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96dce000"
              },
              {
                "name": "ModuleName",
                "value": "RPCRT4.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 124
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d47c714b",
            "parentcaller": "0x7ff6d47c3e77",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadb4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 125
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48182dd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WindowsUpdate\\Orchestrator\\Configurations"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator\\Configurations"
              }
            ],
            "repeated": 0,
            "id": 126
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d481c358",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\TestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\TestHooks"
              }
            ],
            "repeated": 0,
            "id": 127
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 128
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData"
              }
            ],
            "repeated": 0,
            "id": 129
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              }
            ],
            "repeated": 0,
            "id": 130
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared"
              }
            ],
            "repeated": 0,
            "id": 131
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared"
              }
            ],
            "repeated": 0,
            "id": 132
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared\\Logs"
              }
            ],
            "repeated": 0,
            "id": 133
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs"
              }
            ],
            "repeated": 0,
            "id": 134
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System"
              }
            ],
            "repeated": 0,
            "id": 135
          },
          {
            "timestamp": "2026-05-28 22:32:53,825",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System"
              }
            ],
            "repeated": 0,
            "id": 136
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481fced",
            "parentcaller": "0x7ff6d481dc31",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x18ceadaf670",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\*"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xc86967d2"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5acde"
              }
            ],
            "repeated": 0,
            "id": 137
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d481e64e",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadbc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 138
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadbd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 139
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481fa3a",
            "parentcaller": "0x7ff6d481df61",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 140
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.13a40315-1b4b-44fb-bceb-0ac9d0e8d637.1.etl"
              }
            ],
            "repeated": 0,
            "id": 141
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.a1a5ab62-37db-4c6e-a99f-2dd742f7a2ff.1.etl"
              }
            ],
            "repeated": 0,
            "id": 142
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.a1a5ab62-37db-4c6e-a99f-2dd742f7a2ff.2.etl"
              }
            ],
            "repeated": 0,
            "id": 143
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.a1a5ab62-37db-4c6e-a99f-2dd742f7a2ff.3.etl"
              }
            ],
            "repeated": 0,
            "id": 144
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.b2c76306-97b7-4c8c-b9f0-4178717b5f9e.1.etl"
              }
            ],
            "repeated": 0,
            "id": 145
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.d1101e08-df9f-4307-8331-d8089b287d2b.1.etl"
              }
            ],
            "repeated": 0,
            "id": 146
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.2552a42b-ffbc-46bc-915e-0f13d4a35e82.1.etl"
              }
            ],
            "repeated": 0,
            "id": 147
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.decfc9c6-5753-489c-a7e7-63bcdfa32a05.1.etl"
              }
            ],
            "repeated": 0,
            "id": 148
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.decfc9c6-5753-489c-a7e7-63bcdfa32a05.2.etl"
              }
            ],
            "repeated": 0,
            "id": 149
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.decfc9c6-5753-489c-a7e7-63bcdfa32a05.3.etl"
              }
            ],
            "repeated": 0,
            "id": 150
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.72c536ce-f0a9-45b0-8943-d57989691ba2.1.etl"
              }
            ],
            "repeated": 0,
            "id": 151
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.1.etl"
              }
            ],
            "repeated": 0,
            "id": 152
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.2.etl"
              }
            ],
            "repeated": 0,
            "id": 153
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.3.etl"
              }
            ],
            "repeated": 0,
            "id": 154
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.4.etl"
              }
            ],
            "repeated": 0,
            "id": 155
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.52b3bb53-50da-43e2-a227-8eee56d653f4.1.etl"
              }
            ],
            "repeated": 0,
            "id": 156
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.52b3bb53-50da-43e2-a227-8eee56d653f4.2.etl"
              }
            ],
            "repeated": 0,
            "id": 157
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.52b3bb53-50da-43e2-a227-8eee56d653f4.3.etl"
              }
            ],
            "repeated": 0,
            "id": 158
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.7eb22526-c9d8-474a-a640-c2711afee09f.1.etl"
              }
            ],
            "repeated": 0,
            "id": 159
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.7eb22526-c9d8-474a-a640-c2711afee09f.2.etl"
              }
            ],
            "repeated": 0,
            "id": 160
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.58407556-a7aa-4ece-be15-b623579ad3a0.1.etl"
              }
            ],
            "repeated": 0,
            "id": 161
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.58407556-a7aa-4ece-be15-b623579ad3a0.2.etl"
              }
            ],
            "repeated": 0,
            "id": 162
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.937edd1c-b31a-42ae-b43a-a5fef1121bff.1.etl"
              }
            ],
            "repeated": 0,
            "id": 163
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.937edd1c-b31a-42ae-b43a-a5fef1121bff.2.etl"
              }
            ],
            "repeated": 0,
            "id": 164
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.0c40a8b7-8c96-44ca-898f-830fcb363207.1.etl"
              }
            ],
            "repeated": 0,
            "id": 165
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.f78383b3-3d11-4f06-94bb-4259c0caa1e0.1.etl"
              }
            ],
            "repeated": 0,
            "id": 166
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.afe6ad17-1c4d-4f58-955e-3728f67e8730.1.etl"
              }
            ],
            "repeated": 0,
            "id": 167
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.9b10e438-09b6-42b5-b0ef-b89137a942d6.1.etl"
              }
            ],
            "repeated": 0,
            "id": 168
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.9b10e438-09b6-42b5-b0ef-b89137a942d6.2.etl"
              }
            ],
            "repeated": 0,
            "id": 169
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.9b10e438-09b6-42b5-b0ef-b89137a942d6.3.etl"
              }
            ],
            "repeated": 0,
            "id": 170
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 0,
            "id": 171
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System"
              }
            ],
            "repeated": 0,
            "id": 172
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadc0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 173
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 1,
            "id": 174
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xe8\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\xdc\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "4572"
              }
            ],
            "repeated": 0,
            "id": 175
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "1"
              },
              {
                "name": "ThreadInformation",
                "value": ";\\xd6}\\xec\\xf1\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb4\\xc4\\x04\\x00\\x00\\x00\\x00\\x00\\x1cN\\x0e\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "4572"
              }
            ],
            "repeated": 0,
            "id": 176
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              }
            ],
            "repeated": 0,
            "id": 177
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000278"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
              }
            ],
            "repeated": 0,
            "id": 178
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000278"
              },
              {
                "name": "ValueName",
                "value": "~MHz"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "3686"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\~MHz"
              }
            ],
            "repeated": 0,
            "id": 179
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000278"
              }
            ],
            "repeated": 0,
            "id": 180
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 181
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 182
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x82000000",
                "pretty_value": "0x82000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\TimeZoneInformation"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\TimeZoneInformation"
              }
            ],
            "repeated": 0,
            "id": 183
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb3d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 184
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "Bias"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "300"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\Bias"
              }
            ],
            "repeated": 0,
            "id": 185
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "StandardName"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Eastern Standard Time"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardName"
              }
            ],
            "repeated": 0,
            "id": 186
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "StandardBias"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardBias"
              }
            ],
            "repeated": 0,
            "id": 187
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "StandardStart"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x00\\x00\\x0b\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardStart"
              }
            ],
            "repeated": 0,
            "id": 188
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "DaylightName"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Eastern Daylight Time"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightName"
              }
            ],
            "repeated": 0,
            "id": 189
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "DaylightBias"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "18446744073709551556"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightBias"
              }
            ],
            "repeated": 0,
            "id": 190
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "DaylightStart"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x00\\x00\\x03\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightStart"
              }
            ],
            "repeated": 0,
            "id": 191
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb3d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 192
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 193
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control"
              }
            ],
            "repeated": 0,
            "id": 194
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "ContainerId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerId"
              }
            ],
            "repeated": 0,
            "id": 195
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 196
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control"
              }
            ],
            "repeated": 0,
            "id": 197
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "ContainerCorrelationId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerCorrelationId"
              }
            ],
            "repeated": 0,
            "id": 198
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 199
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control"
              }
            ],
            "repeated": 0,
            "id": 200
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ValueName",
                "value": "ContainerType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerType"
              }
            ],
            "repeated": 0,
            "id": 201
          },
          {
            "timestamp": "2026-05-28 22:32:53,840",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000027c"
              }
            ],
            "repeated": 0,
            "id": 202
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x00\\xb0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb0\\x02\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xc0\\x18\\x02\\x00\\x00\\xdc\\x11\\x00\\x00`\\x1f\\x00\\x00{\\xd0\\x9a\\xec\\xf1\\xee\\xdc\\x01\\x02\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x10\\x00\\x00\n\\x00\\x01\\x05eJ\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Zb\\x02\\x00K\\x00\\x00\\x00\\x08(\\x02\\x10\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x01\\x00\\x00E\\x00a\\x00s\\x00t\\x00e\\x00r\\x00n\\x00 \\x00S\\x00t\\x00a\\x00n\\x00d\\x00a\\x00r\\x00d\\x00 \\x00T\\x00i\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x02\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 203
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb3d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 204
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb3d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 205
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb3d1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 206
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff98ca5040"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadb9cf0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12584"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "Module",
                "value": "ntdll.dll"
              }
            ],
            "repeated": 0,
            "id": 207
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "threading",
            "api": "RtlCreateUserThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "CreateSuspended",
                "value": "1"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff98ca5040"
              },
              {
                "name": "StartParameter",
                "value": "0x18ceadb9cf0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x0000027c"
              },
              {
                "name": "ThreadId",
                "value": "12584"
              }
            ],
            "repeated": 0,
            "id": 208
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x0000027c"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "12584"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              }
            ],
            "repeated": 0,
            "id": 209
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c38a1",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadbf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 210
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData"
              }
            ],
            "repeated": 0,
            "id": 211
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              }
            ],
            "repeated": 0,
            "id": 212
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 213
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared"
              }
            ],
            "repeated": 0,
            "id": 214
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared"
              }
            ],
            "repeated": 0,
            "id": 215
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared\\Logs"
              }
            ],
            "repeated": 0,
            "id": 216
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs"
              }
            ],
            "repeated": 0,
            "id": 217
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System"
              }
            ],
            "repeated": 0,
            "id": 218
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System"
              }
            ],
            "repeated": 0,
            "id": 219
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481fced",
            "parentcaller": "0x7ff6d481dc31",
            "category": "filesystem",
            "api": "FindFirstFileExW",
            "status": true,
            "return": "0x18ceadafa30",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\*"
              },
              {
                "name": "FirstCreateTimeLow",
                "value": "0xc86967d2"
              },
              {
                "name": "FirstCreateTimeHigh",
                "value": "0x01d5acde"
              }
            ],
            "repeated": 0,
            "id": 220
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481fa3a",
            "parentcaller": "0x7ff6d481df61",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 221
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.22cdc50a-cbbc-43d5-9b6f-1baf2061d080.1.etl"
              }
            ],
            "repeated": 0,
            "id": 222
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.b45f93e0-f36f-42dc-813e-744a27246b93.1.etl"
              }
            ],
            "repeated": 0,
            "id": 223
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.43ccf5e4-1a64-4806-a968-4dbbdacf42d8.1.etl"
              }
            ],
            "repeated": 0,
            "id": 224
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.d0de2613-3e9a-4f7a-917e-d63be9a15b6a.1.etl"
              }
            ],
            "repeated": 0,
            "id": 225
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.b79f1d0b-e492-41de-a46a-62bc2a94231b.1.etl"
              }
            ],
            "repeated": 0,
            "id": 226
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.daea7507-dffc-4d97-803c-02c903841e52.1.etl"
              }
            ],
            "repeated": 0,
            "id": 227
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.d8065493-d7b3-450d-bec9-4d0b7cd2aa27.1.etl"
              }
            ],
            "repeated": 0,
            "id": 228
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.9d0d101b-258a-40f4-92ef-6b1e4244a564.1.etl"
              }
            ],
            "repeated": 0,
            "id": 229
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.63023b64-7a0c-49ce-874f-111955c9e399.1.etl"
              }
            ],
            "repeated": 0,
            "id": 230
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.87eafcac-ca88-4bad-ba8d-d502a2b76bd5.1.etl"
              }
            ],
            "repeated": 0,
            "id": 231
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.5a750c04-2df5-4e80-9376-dc237123101f.1.etl"
              }
            ],
            "repeated": 0,
            "id": 232
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.c7554215-ef05-48af-a85d-890d84e75d01.1.etl"
              }
            ],
            "repeated": 0,
            "id": 233
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.5e2f3d21-5ec7-48df-a172-b94291764279.1.etl"
              }
            ],
            "repeated": 0,
            "id": 234
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.c294fc97-7fbd-4ef0-9dda-00a41c45cbf3.1.etl"
              }
            ],
            "repeated": 0,
            "id": 235
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.c48e4ebc-c7f0-4655-8df7-4bbde3bcef8d.1.etl"
              }
            ],
            "repeated": 0,
            "id": 236
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d481e05b",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.86e3852b-7fa1-4e18-b069-98171a34fa8b.1.etl"
              }
            ],
            "repeated": 0,
            "id": 237
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\MiniNT"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT"
              }
            ],
            "repeated": 0,
            "id": 238
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System"
              }
            ],
            "repeated": 0,
            "id": 239
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 1,
            "id": 240
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xe8\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\xdc\\x11\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "4572"
              }
            ],
            "repeated": 0,
            "id": 241
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "1"
              },
              {
                "name": "ThreadInformation",
                "value": ";\\xd6}\\xec\\xf1\\xee\\xdc\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xb4\\xc4\\x04\\x00\\x00\\x00\\x00\\x00\\x1cN\\x0e\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "4572"
              }
            ],
            "repeated": 0,
            "id": 242
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              }
            ],
            "repeated": 0,
            "id": 243
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0"
              }
            ],
            "repeated": 0,
            "id": 244
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000290"
              },
              {
                "name": "ValueName",
                "value": "~MHz"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "3686"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\~MHz"
              }
            ],
            "repeated": 0,
            "id": 245
          },
          {
            "timestamp": "2026-05-28 22:32:53,856",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000290"
              }
            ],
            "repeated": 0,
            "id": 246
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000290"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.a11b7b39-47d3-4445-ba94-a9ffc89781cb.1.etl"
              },
              {
                "name": "CreateDisposition",
                "value": "5",
                "pretty_value": "FILE_OVERWRITE_IF"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 247
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "filesystem",
            "api": "NtSetInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000290"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.a11b7b39-47d3-4445-ba94-a9ffc89781cb.1.etl"
              },
              {
                "name": "FileInformationClass",
                "value": "4",
                "pretty_value": "FileBasicInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 248
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x82000000",
                "pretty_value": "0x82000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\TimeZoneInformation"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\TimeZoneInformation"
              }
            ],
            "repeated": 0,
            "id": 249
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb3f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 250
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "Bias"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "300"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\Bias"
              }
            ],
            "repeated": 0,
            "id": 251
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "StandardName"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Eastern Standard Time"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardName"
              }
            ],
            "repeated": 0,
            "id": 252
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "StandardBias"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardBias"
              }
            ],
            "repeated": 0,
            "id": 253
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "StandardStart"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x00\\x00\\x0b\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardStart"
              }
            ],
            "repeated": 0,
            "id": 254
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "DaylightName"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Eastern Daylight Time"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightName"
              }
            ],
            "repeated": 0,
            "id": 255
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "DaylightBias"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "18446744073709551556"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightBias"
              }
            ],
            "repeated": 0,
            "id": 256
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "DaylightStart"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": "\\x00\\x00\\x03\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightStart"
              }
            ],
            "repeated": 0,
            "id": 257
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb3f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 258
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 259
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control"
              }
            ],
            "repeated": 0,
            "id": 260
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "ContainerId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerId"
              }
            ],
            "repeated": 0,
            "id": 261
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 262
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control"
              }
            ],
            "repeated": 0,
            "id": 263
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "ContainerCorrelationId"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerCorrelationId"
              }
            ],
            "repeated": 0,
            "id": 264
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 265
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control"
              }
            ],
            "repeated": 0,
            "id": 266
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000294"
              },
              {
                "name": "ValueName",
                "value": "ContainerType"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerType"
              }
            ],
            "repeated": 0,
            "id": 267
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000294"
              }
            ],
            "repeated": 0,
            "id": 268
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000290"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.a11b7b39-47d3-4445-ba94-a9ffc89781cb.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x00\\xa0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\x02\\x00\\x00\\x01\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\xc0\\x04\\x02\\x00\\x00\\xdc\\x11\\x00\\x00`\\x1f\\x00\\x00<u\\x9e\\xec\\xf1\\xee\\xdc\\x01\\x02\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x00\\x10\\x00\\x00\n\\x00\\x01\\x05eJ\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Zb\\x02\\x00K\\x00\\x00\\x00\\x08(\\x02\\x10\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00f\\x0e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00,\\x01\\x00\\x00E\\x00a\\x00s\\x00t\\x00e\\x00r\\x00n\\x00 \\x00S\\x00t\\x00a\\x00n\\x00d\\x00a\\x00r\\x00d\\x00 \\x00T\\x00i\\x00m\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x02\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 269
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb5f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 270
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb5f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 271
          },
          {
            "timestamp": "2026-05-28 22:32:53,872",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb5f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 272
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000294"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff98ca5040"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadce6b0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12596"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "Module",
                "value": "ntdll.dll"
              }
            ],
            "repeated": 0,
            "id": 273
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "threading",
            "api": "RtlCreateUserThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "CreateSuspended",
                "value": "1"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff98ca5040"
              },
              {
                "name": "StartParameter",
                "value": "0x18ceadce6b0"
              },
              {
                "name": "ThreadHandle",
                "value": "0x00000294"
              },
              {
                "name": "ThreadId",
                "value": "12596"
              }
            ],
            "repeated": 0,
            "id": 274
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "threading",
            "api": "NtResumeThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000294"
              },
              {
                "name": "SuspendCount",
                "value": "1"
              },
              {
                "name": "ThreadId",
                "value": "12596"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              }
            ],
            "repeated": 0,
            "id": 275
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadbf000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 276
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadcf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 277
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d481d86d",
            "parentcaller": "0x7ff6d47c3a13",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadbf000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 278
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c3fef",
            "parentcaller": "0x7ff6d48cf886",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadcf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 279
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c3fef",
            "parentcaller": "0x7ff6d48cf886",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 280
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "12596",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 281
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "12596",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca5040"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadce6b0"
              }
            ],
            "repeated": 0,
            "id": 282
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "12596",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000288"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 283
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c4020",
            "parentcaller": "0x7ff6d48cf886",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "MutexName",
                "value": "Global\\MoUsoCoreworkerRunning"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 284
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c408f",
            "parentcaller": "0x7ff6d48cf886",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002a0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 285
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c40f8",
            "parentcaller": "0x7ff6d48cf886",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\clbcatq"
              },
              {
                "name": "DllBase",
                "value": "0x7fff98230000"
              }
            ],
            "repeated": 0,
            "id": 286
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c40f8",
            "parentcaller": "0x7ff6d48cf886",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000034B-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "0000015B-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 287
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c3dbf",
            "parentcaller": "0x7ff6d47c4144",
            "category": "synchronization",
            "api": "NtCreateEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002d4"
              },
              {
                "name": "EventName",
                "value": "Global\\UsoCoreWorkerRequestShutdown"
              },
              {
                "name": "EventType",
                "value": "0"
              },
              {
                "name": "InitialState",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 288
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47bde7d",
            "parentcaller": "0x7ff6d47becc3",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 289
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47bde9a",
            "parentcaller": "0x7ff6d47becc3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 290
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c42c6",
            "parentcaller": "0x7ff6d48cf886",
            "category": "misc",
            "api": "GetCommandLineW",
            "status": true,
            "return": "0x18cead620e8",
            "arguments": [
              {
                "name": "CommandLine",
                "value": "C:\\Windows\\System32\\mousocoreworker.exe -Embedding"
              }
            ],
            "repeated": 0,
            "id": 291
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a8"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}"
              },
              {
                "name": "Handle",
                "value": "0x000002dc"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}"
              }
            ],
            "repeated": 0,
            "id": 292
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002dc"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 293
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 294
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002dc"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 295
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 296
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 297
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "MoUsoCoreWorker COM class"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 298
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002dc"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 299
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002dc"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 300
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 301
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002dc"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 302
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002dc"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 303
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002dc"
              }
            ],
            "repeated": 0,
            "id": 304
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 305
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 306
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 307
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 308
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 309
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 310
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 311
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "164"
              }
            ],
            "repeated": 0,
            "id": 312
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx"
              }
            ],
            "repeated": 0,
            "id": 313
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e0"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 314
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 315
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock"
              }
            ],
            "repeated": 0,
            "id": 316
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002e0"
              },
              {
                "name": "ValueName",
                "value": "AllowDevelopmentWithoutDevLicense"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense"
              }
            ],
            "repeated": 0,
            "id": 317
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 318
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 319
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 320
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 321
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 322
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 323
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 324
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 325
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "ValueName",
                "value": "RaiseActivationAuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 326
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 327
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "AppID\\mousocoreworker.exe"
              },
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\mousocoreworker.exe"
              }
            ],
            "repeated": 0,
            "id": 328
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "Data",
                "value": "{D726464B-98F1-4627-86CD-4A082A1E5307}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\mousocoreworker.exe\\AppID"
              }
            ],
            "repeated": 0,
            "id": 329
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 330
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}"
              },
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}"
              }
            ],
            "repeated": 0,
            "id": 331
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "ValueName",
                "value": "AuthenticationLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AuthenticationLevel"
              }
            ],
            "repeated": 0,
            "id": 332
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE\\AppCompat"
              },
              {
                "name": "Handle",
                "value": "0x000002e4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat"
              }
            ],
            "repeated": 0,
            "id": 333
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e4"
              },
              {
                "name": "ValueName",
                "value": "RaiseDefaultAuthnLevel"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel"
              }
            ],
            "repeated": 0,
            "id": 334
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e4"
              }
            ],
            "repeated": 0,
            "id": 335
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              },
              {
                "name": "ValueName",
                "value": "AccessPermission"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x04\\x80\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x9c\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x00\\x00(\\x00\\x03\\x00\\x00\\x00\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AccessPermission"
              }
            ],
            "repeated": 0,
            "id": 336
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 337
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 338
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 339
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002e0"
              }
            ],
            "repeated": 0,
            "id": 340
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 341
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff97321000"
              },
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 342
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": false,
            "return": "0xffffffffc0000135",
            "pretty_return": "DLL_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\system32\\rpcss.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 343
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 344
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00001f60"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.COM.DISABLE.8032"
              }
            ],
            "repeated": 0,
            "id": 345
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "EventName",
                "value": "MSFT.VSA.IEC.STATUS.6c736db0"
              }
            ],
            "repeated": 0,
            "id": 346
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{00000134-0000-0000-C000-000000000046}"
              },
              {
                "name": "Handle",
                "value": "0x000002ec"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}"
              }
            ],
            "repeated": 0,
            "id": 347
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002ec"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 348
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{00000320-0000-0000-C000-000000000046}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 349
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 350
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 351
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 352
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002ec"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 353
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 354
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 355
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xdf\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 356
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xe0\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 357
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 358
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x1f\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 359
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 360
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\t\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 361
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x18\\xb7\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00`\\xe4\\xd5\\xa3?\\x00\\x00\\x00X\\xe4\\xd5\\xa3?\\x00\\x00\\x00(\\xe4\\xd5\\xa3?\\x00\\x00\\x00H\\xe4\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 362
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\t\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00H\\xe2\\xd5\\xa3?\\x00\\x00\\x00\\xf0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 363
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 364
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xe6\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 365
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc0\\xe9\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 366
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 367
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\x1d\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 368
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 369
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\n\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 370
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xb8\\xb4\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xc0\\xe0\\xd5\\xa3?\\x00\\x00\\x00\\xb8\\xe0\\xd5\\xa3?\\x00\\x00\\x00\\x88\\xe0\\xd5\\xa3?\\x00\\x00\\x00\\xa8\\xe0\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 371
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\n\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xa8\\xde\\xd5\\xa3?\\x00\\x00\\x00\\xf0\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 372
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002ec"
              }
            ],
            "repeated": 0,
            "id": 373
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f0"
              }
            ],
            "repeated": 0,
            "id": 374
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 375
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 376
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x18cead95df0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12604"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "Module",
                "value": "combase.dll"
              }
            ],
            "repeated": 0,
            "id": 377
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002f4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x18cead95df0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12604"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              }
            ],
            "repeated": 0,
            "id": 378
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 379
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 380
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 381
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 382
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 383
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xf4\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 384
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xf5\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 385
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 386
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\x1e\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 387
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 388
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xfe\\xda\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 389
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00H\\xb3\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x000\\xe8\\xd5\\xa3?\\x00\\x00\\x00(\\xe8\\xd5\\xa3?\\x00\\x00\\x00\\xf8\\xe7\\xd5\\xa3?\\x00\\x00\\x00\\x18\\xe8\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 390
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfe\\xda\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\xd5\\xa3?\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 391
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 392
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xef\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x10\\x96\\x00\\x00\\xf0\\x00\\xd6\\xea\\x8c\\x01\\x00\\x00\\xf0\\x00\\xd6\\xea\\x8c\\x01\\x00\\x00`\\x00\\xd6\\xea\\x8c\\x01\\x00\\x00`\\x00\\xd6\\xea\\x8c\\x01\\x00\\x00\\x00\\xf0\\xda\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x0b\\x00"
              }
            ],
            "repeated": 0,
            "id": 393
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xf3\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 394
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 395
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x1e\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 396
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 397
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\t\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 398
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xe8\\xb0\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x90\\xe4\\xd5\\xa3?\\x00\\x00\\x00\\x88\\xe4\\xd5\\xa3?\\x00\\x00\\x00X\\xe4\\xd5\\xa3?\\x00\\x00\\x00x\\xe4\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 399
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\t\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\xd5\\xa3?\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 400
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 401
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 402
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 403
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 404
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 405
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 406
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xdf\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 407
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xe0\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 408
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "12604",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 409
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 410
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "12604",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff97092d30"
              },
              {
                "name": "Parameter",
                "value": "0x18cead95df0"
              }
            ],
            "repeated": 0,
            "id": 411
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x1d\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 412
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 413
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xff\\xda\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 414
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00H\\xb3\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x000\\xe8\\xd5\\xa3?\\x00\\x00\\x00(\\xe8\\xd5\\xa3?\\x00\\x00\\x00\\xf8\\xe7\\xd5\\xa3?\\x00\\x00\\x00\\x18\\xe8\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 415
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xff\\xda\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\xd5\\xa3?\\x00\\x00\\x00\\xf4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 416
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 417
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xed\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 418
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xf0\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 419
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 420
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\x1d\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 421
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 422
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x0b\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 423
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xe8\\xb0\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x90\\xe4\\xd5\\xa3?\\x00\\x00\\x00\\x88\\xe4\\xd5\\xa3?\\x00\\x00\\x00X\\xe4\\xd5\\xa3?\\x00\\x00\\x00x\\xe4\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 424
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x0b\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\xd5\\xa3?\\x00\\x00\\x00\\xf4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 425
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 426
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 427
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 428
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 429
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 430
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 431
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\xe3\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 432
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe0\\xed\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x05\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 433
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 434
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "x\\x1c\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 435
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 436
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\xff\\xda\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 437
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00H\\xb3\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x000\\xe8\\xd5\\xa3?\\x00\\x00\\x00(\\xe8\\xd5\\xa3?\\x00\\x00\\x00\\xf8\\xe7\\xd5\\xa3?\\x00\\x00\\x00\\x18\\xe8\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 438
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\xff\\xda\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\xd5\\xa3?\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 439
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 440
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xe2\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 441
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xef\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 442
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 443
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\x1d\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 444
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 445
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\x04\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 446
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xe8\\xb0\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x90\\xe4\\xd5\\xa3?\\x00\\x00\\x00\\x88\\xe4\\xd5\\xa3?\\x00\\x00\\x00X\\xe4\\xd5\\xa3?\\x00\\x00\\x00x\\xe4\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 447
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x04\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\xd5\\xa3?\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 448
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 449
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 450
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 451
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002fc"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 452
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 453
          },
          {
            "timestamp": "2026-05-28 22:32:53,887",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 454
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xee\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 455
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": " \\xf0\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 456
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 457
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\x1e\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 458
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 459
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\x07\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 460
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00H\\xb3\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x000\\xe8\\xd5\\xa3?\\x00\\x00\\x00(\\xe8\\xd5\\xa3?\\x00\\x00\\x00\\xf8\\xe7\\xd5\\xa3?\\x00\\x00\\x00\\x18\\xe8\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 461
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x07\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x18\\xe6\\xd5\\xa3?\\x00\\x00\\x00\\xf4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 462
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 463
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "X\\xef\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 464
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xde\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 465
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 466
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x1e\\xdc\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 467
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 468
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x05\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 469
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xe8\\xb0\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x90\\xe4\\xd5\\xa3?\\x00\\x00\\x00\\x88\\xe4\\xd5\\xa3?\\x00\\x00\\x00X\\xe4\\xd5\\xa3?\\x00\\x00\\x00x\\xe4\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 470
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x05\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xe2\\xd5\\xa3?\\x00\\x00\\x00\\xf4\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 471
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 472
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 473
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 474
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb4e7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 475
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 476
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x18cead60b50"
              }
            ],
            "repeated": 0,
            "id": 477
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000310"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 478
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 479
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 480
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 481
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 482
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xf4\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 483
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\xe0\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 484
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 485
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb8\\x82\\xd7\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 486
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 487
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xfe\\xda\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 488
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x008\\xb1\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00@\\xe6\\xd5\\xa3?\\x00\\x00\\x008\\xe6\\xd5\\xa3?\\x00\\x00\\x00\\x08\\xe6\\xd5\\xa3?\\x00\\x00\\x00(\\xe6\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 489
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\xfe\\xda\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00(\\xe4\\xd5\\xa3?\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 490
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 491
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xdf\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 492
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xe8\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 493
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 494
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\x82\\xd7\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 495
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 496
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8\\x08\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 497
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xd8\\xb6\\xb9\\x9f\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xa0\\xe2\\xd5\\xa3?\\x00\\x00\\x00\\x98\\xe2\\xd5\\xa3?\\x00\\x00\\x00h\\xe2\\xd5\\xa3?\\x00\\x00\\x00\\x88\\xe2\\xd5\\xa3"
              }
            ],
            "repeated": 0,
            "id": 498
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xc0\\x08\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x88\\xe0\\xd5\\xa3?\\x00\\x00\\x00\\xfc\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 499
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 500
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 501
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\OLE"
              },
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE"
              }
            ],
            "repeated": 0,
            "id": 502
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "ValueName",
                "value": "MaxSxSHashCount"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount"
              }
            ],
            "repeated": 0,
            "id": 503
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              }
            ],
            "repeated": 0,
            "id": 504
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 505
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c69f3",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 506
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c6a84",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7ff6d47c6cc0"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadb0940"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12632"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "Module",
                "value": "mousocoreworker.exe"
              }
            ],
            "repeated": 0,
            "id": 507
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c6a84",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x000002f4",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7ff6d47c6cc0"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadb0940"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12632"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              }
            ],
            "repeated": 0,
            "id": 508
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12628",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadd1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 509
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12632",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 510
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12628",
            "caller": "0x7fff96536f4c",
            "parentcaller": "0x7fff96cdef53",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000320"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 511
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12632",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7ff6d47c6cc0"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadb0940"
              }
            ],
            "repeated": 0,
            "id": 512
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12632",
            "caller": "0x7ff6d47c6cd7",
            "parentcaller": "0x00000000",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002fc"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 513
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadd2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 514
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c6ae6",
            "parentcaller": "0x7ff6d47c42e4",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 515
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "9\\xb7\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\t\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 516
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d47c3bb8",
            "parentcaller": "0x7ff6d47c42f3",
            "category": "system",
            "api": "NtDuplicateObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SourceProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "SourceHandle",
                "value": "0x000002d4"
              },
              {
                "name": "TargetProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "TargetHandle",
                "value": "0x00000324"
              },
              {
                "name": "Options",
                "value": "0x00000002"
              }
            ],
            "repeated": 0,
            "id": 517
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 518
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0d8b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 519
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadd4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 520
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "4572",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0d8b",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 521
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c42bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9706b0b0"
              }
            ],
            "repeated": 0,
            "id": 522
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c42e9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97068b50"
              }
            ],
            "repeated": 0,
            "id": 523
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c4313",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "StringFromIID"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97099780"
              }
            ],
            "repeated": 0,
            "id": 524
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c433d",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemAlloc"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970a2e80"
              }
            ],
            "repeated": 0,
            "id": 525
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c4367",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoTaskMemFree"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff970a1b70"
              }
            ],
            "repeated": 0,
            "id": 526
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c4391",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoCreateInstance"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701a420"
              }
            ],
            "repeated": 0,
            "id": 527
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff970c43bb",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701e790"
              }
            ],
            "repeated": 0,
            "id": 528
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff970c41cf",
            "parentcaller": "0x7fff98c938c0",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0000032A-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "00000149-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 529
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff9704b0ca",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 530
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff970692b9",
            "parentcaller": "0x7fff970a224d",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000338-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 531
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 532
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 533
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}"
              }
            ],
            "repeated": 0,
            "id": 534
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 535
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 536
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9709fad3",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 537
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 538
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a8"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              }
            ],
            "repeated": 0,
            "id": 539
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 540
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 541
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 542
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 543
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 544
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Uso Core Service Proxy Stub"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 545
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 546
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 547
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 548
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\usocoreps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 549
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 550
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 551
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 552
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 553
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 554
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 555
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 556
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 557
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 558
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a8"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              }
            ],
            "repeated": 0,
            "id": 559
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 560
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 561
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 562
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 563
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 564
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Uso Core Service Proxy Stub"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 565
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 566
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 567
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 568
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\usocoreps.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 569
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 570
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 571
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 572
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 573
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 574
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 575
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 576
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 577
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 578
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000002f4"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 579
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a8"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "Handle",
                "value": "0x0000032c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              }
            ],
            "repeated": 0,
            "id": 580
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9702ad4d",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x0000032c"
              },
              {
                "name": "SubKey",
                "value": "Elevation"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 581
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000032c"
              }
            ],
            "repeated": 0,
            "id": 582
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 583
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}"
              }
            ],
            "repeated": 0,
            "id": 584
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9709f8f8",
            "parentcaller": "0x7fff9702213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002f4"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 585
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff97022160",
            "parentcaller": "0x7fff97019277",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 586
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 587
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 588
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\usocoreps"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7de30000"
              }
            ],
            "repeated": 0,
            "id": 589
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\usocoreps.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7de30000"
              }
            ],
            "repeated": 0,
            "id": 590
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff7de30000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\usocoreps.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 591
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usocoreps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7de30000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7de33ca0"
              }
            ],
            "repeated": 0,
            "id": 592
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usocoreps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7de30000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 593
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usocoreps.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff7de30000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff7de33e10"
              }
            ],
            "repeated": 0,
            "id": 594
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 595
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 596
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 597
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 598
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8\\xe7\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 599
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x80\\xde\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 600
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 601
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc8G\\xdd\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 602
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 603
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x08\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 604
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xe8\\xd1#\\x98\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x90\\xc5O\\xa4?\\x00\\x00\\x00\\x88\\xc5O\\xa4?\\x00\\x00\\x00X\\xc5O\\xa4?\\x00\\x00\\x00x\\xc5O\\xa4"
              }
            ],
            "repeated": 0,
            "id": 605
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x08\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00x\\xc3O\\xa4?\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 606
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 607
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\xe5\\xda\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 608
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "@\\xe8\\xda\\xea\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 609
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 610
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08K\\xdd\\xea\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 611
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 612
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "H\\x05\\xdb\\xea\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 613
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x88\\xd5#\\x98\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xf0\\xc1O\\xa4?\\x00\\x00\\x00\\xe8\\xc1O\\xa4?\\x00\\x00\\x00\\xb8\\xc1O\\xa4?\\x00\\x00\\x00\\xd8\\xc1O\\xa4"
              }
            ],
            "repeated": 0,
            "id": 614
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x05\\xdb\\xea\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xd8\\xbfO\\xa4?\\x00\\x00\\x000\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 615
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e27",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 616
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff96cc0e49",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000330"
              }
            ],
            "repeated": 0,
            "id": 617
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff964fe76a",
            "parentcaller": "0x7fff97030e64",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              }
            ],
            "repeated": 0,
            "id": 618
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030e82",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoGetMarshalSizeMax"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9705c590"
              }
            ],
            "repeated": 0,
            "id": 619
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030e9f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoMarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9706b0b0"
              }
            ],
            "repeated": 0,
            "id": 620
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030ebc",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoUnmarshalInterface"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff97068b50"
              }
            ],
            "repeated": 0,
            "id": 621
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97030ed9",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "combase.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff96ff0000"
              },
              {
                "name": "FunctionName",
                "value": "CoReleaseMarshalData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff9701e790"
              }
            ],
            "repeated": 0,
            "id": 622
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 623
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d4807c60",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadd8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 624
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceaddb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 625
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d4815e84",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceaddd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 626
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd138",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceaddf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 627
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47c89c5",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceade1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 628
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d4815e84",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceade4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 629
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d4815e84",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceade6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 630
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12644",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 631
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12644",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x18cead60b50"
              }
            ],
            "repeated": 0,
            "id": 632
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d47cf79f",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 633
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d47cf79f",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "UpdateManagerCtorFailures"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures"
              }
            ],
            "repeated": 0,
            "id": 634
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d47cf79f",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 635
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12648",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 636
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12648",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff98ca2b30"
              },
              {
                "name": "Parameter",
                "value": "0x18cead60b50"
              }
            ],
            "repeated": 0,
            "id": 637
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 638
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "UpdateManagerCtorFailures"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures"
              }
            ],
            "repeated": 0,
            "id": 639
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 640
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 641
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 642
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 643
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "UpdateManagerCtorFailures"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures"
              }
            ],
            "repeated": 0,
            "id": 644
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 645
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 646
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 647
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "AllowedUpdateManagerCtorFailures"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\AllowedUpdateManagerCtorFailures"
              }
            ],
            "repeated": 0,
            "id": 648
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 649
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47cfd96",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 650
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47cfd96",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 651
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47cfd96",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000002",
                "pretty_value": "KEY_SET_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 652
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47cfd96",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              },
              {
                "name": "ValueName",
                "value": "UpdateManagerCtorFailures"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "1"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures"
              }
            ],
            "repeated": 0,
            "id": 653
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47cfd96",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002f4"
              }
            ],
            "repeated": 0,
            "id": 654
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a42",
            "parentcaller": "0x7ff6d481adfa",
            "category": "misc",
            "api": "GetSystemInfo",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 655
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData"
              }
            ],
            "repeated": 0,
            "id": 656
          },
          {
            "timestamp": "2026-05-28 22:32:53,903",
            "thread_id": "12624",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData"
              }
            ],
            "repeated": 0,
            "id": 657
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOPrivate"
              }
            ],
            "repeated": 0,
            "id": 658
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate"
              }
            ],
            "repeated": 0,
            "id": 659
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d486485e",
            "parentcaller": "0x7ff6d48206ea",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore"
              }
            ],
            "repeated": 0,
            "id": 660
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d48648a1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore"
              }
            ],
            "repeated": 0,
            "id": 661
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48645e0",
            "parentcaller": "0x7ff6d47ebb76",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              }
            ],
            "repeated": 0,
            "id": 662
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48654f9",
            "parentcaller": "0x7ff6d4865a6f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceade9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 663
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48654f9",
            "parentcaller": "0x7ff6d4865a6f",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              }
            ],
            "repeated": 0,
            "id": 664
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48654f9",
            "parentcaller": "0x7ff6d4865a6f",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 665
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48654f9",
            "parentcaller": "0x7ff6d4865a6f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 666
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48654f9",
            "parentcaller": "0x7ff6d4865a6f",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe7\\x00.8\\x08"
              },
              {
                "name": "Length",
                "value": "100"
              }
            ],
            "repeated": 0,
            "id": 667
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48654f9",
            "parentcaller": "0x7ff6d4865a6f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadec000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 668
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48654f9",
            "parentcaller": "0x7ff6d4865a6f",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceadef000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 669
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48658a6",
            "parentcaller": "0x7ff6d486552e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 670
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48658a6",
            "parentcaller": "0x7ff6d486552e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 671
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48658a6",
            "parentcaller": "0x7ff6d486552e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 672
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48658a6",
            "parentcaller": "0x7ff6d486552e",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae0d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 673
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d48658a6",
            "parentcaller": "0x7ff6d486552e",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe7\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 674
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 675
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 676
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 677
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 678
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\r\n\\xde\\x00\\x05\\x06\\xf3\\x00\r\\xf8\\x0f\\x9b\\x0bD\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 679
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae23000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 680
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 681
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 682
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 683
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 684
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae26000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 685
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae3c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 686
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\xcc\\x00\\x00\\x03\\xef\\x00\\x00\\x03\\xee\\x00\\x00\\x00$\\x00\\x00\\x00%\\x00\\x00\\x00&\\x00\\x00\\x00'\\x00\\x00\\x00(\\x00\\x00\\x00)\\x00\\x00\\x00*\\x00\\x00\\x00+\\x00\\x00\\x00,\\x00\\x00\\x00-\\x00\\x00\\x00.\\x00\\x00\\x00/\\x00\\x00\\x000\\x00\\x00\\x001\\x00\\x00\\x002\\x00\\x00\\x003\\x00\\x00\\x004\\x00\\x00\\x005\\x00\\x00\\x006\\x00\\x00\\x007\\x00\\x00\\x008\\x00\\x00\\x009\\x00\\x00\\x00:\\x00\\x00\\x00;\\x00\\x00\\x00<\\x00\\x00\\x00=\\x00\\x00\\x00>\\x00\\x00\\x00?\\x00\\x00\\x00@\\x00\\x00\\x00A\\x00\\x00\\x00B\\x00\\x00\\x00C\\x00\\x00\\x00D\\x00\\x00\\x00E\\x00\\x00\\x00F\\x00\\x00\\x00G\\x00\\x00\\x00H\\x00\\x00\\x00I\\x00\\x00\\x00J\\x00\\x00\\x00K\\x00\\x00\\x00L\\x00\\x00\\x00M\\x00\\x00\\x00N\\x00\\x00\\x00O\\x00\\x00\\x00P\\x00\\x00\\x00Q\\x00\\x00\\x00R\\x00\\x00\\x00S\\x00\\x00\\x00T\\x00\\x00\\x00U\\x00\\x00\\x00V\\x00\\x00\\x00W\\x00\\x00\\x00X\\x00\\x00\\x00Y\\x00\\x00\\x00Z\\x00\\x00\\x00[\\x00\\x00\\x00\\\\x00\\x00\\x00]\\x00\\x00\\x00^\\x00\\x00\\x00_"
              },
              {
                "name": "Length",
                "value": "73728"
              }
            ],
            "repeated": 0,
            "id": 687
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae3e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 688
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xf7P\\x00z\\x00g\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe3\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x002\\x009\\x00a\\x004\\x001\\x009\\x00a\\x00c\\x00-\\x007\\x009\\x008\\x00a\\x00-\\x004\\x006\\x007\\x009\\x00-\\x008\\x006\\x004\\x00f\\x00-\\x008\\x00c\\x00e\\x007\\x001\\x00e\\x001\\x004\\x00d\\x005\\x005\\x002\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 689
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae40000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 690
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xf90\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00c\\x00k\\x00I\\x00Y\\x00B\\x00h\\x004\\x002\\x00x\\x00p\\x00E\\x00U\\x007\\x00i\\x00B\\x00Y\\x00x\\x00B\\x00O\\x00D\\x001\\x00x\\x00z\\x00s\\x006\\x00s\\x00V\\x00b\\x00s\\x004\\x00E\\x001\\x00Y\\x00e\\x007\\x00a\\x00z\\x00H\\x00R\\x00y\\x00z\\x00b\\x00x\\x00v\\x00L\\x00X\\x00f\\x00y\\x00E\\x000\\x00N\\x00t\\x00D\\x00K\\x00%\\x002\\x00f\\x00u\\x009\\x00w\\x00G\\x00%\\x002\\x00b\\x001\\x00Z\\x008\\x00m\\x00f\\x00%\\x002\\x00f\\x00H\\x00o\\x004\\x00E\\x00G\\x00Y\\x00D\\x00W\\x00z\\x00%\\x002\\x00f\\x00c\\x00s\\x00q\\x00a\\x00B\\x00n\\x003\\x00W\\x00u\\x00A\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe5\\x00\\x00\\x00h\\x00t\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 691
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae42000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 692
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xfbj\\x00m\\x00X\\x00I\\x003\\x00v\\x00J\\x00P\\x00c\\x006\\x00g\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe7\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00b\\x00b\\x005\\x00c\\x005\\x005\\x002\\x00e\\x00-\\x00c\\x007\\x00d\\x007\\x00-\\x004\\x000\\x002\\x003\\x00-\\x009\\x00b\\x00b\\x00d\\x00-\\x00b\\x00d\\x00c\\x008\\x000\\x00a\\x004\\x00b\\x00b\\x000\\x009\\x003\\x00?\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 693
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae44000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 694
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xfdc\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00b\\x00b\\x00d\\x00b\\x00e\\x003\\x006\\x002\\x00-\\x00a\\x00e\\x00d\\x005\\x00-\\x004\\x005\\x006\\x000\\x00-\\x008\\x004\\x004\\x008\\x00-\\x008\\x00c\\x000\\x00c\\x002\\x00b\\x00f\\x007\\x005\\x004\\x004\\x00c\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00e\\x00w\\x00%\\x002\\x00f\\x00m\\x00x\\x00O\\x00l\\x00b\\x00z\\x00%\\x002\\x00b\\x00p\\x00L\\x006\\x00b\\x00R\\x004\\x00i\\x00%\\x002\\x00f\\x00%\\x002\\x00b\\x00u\\x00Y\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 695
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae46000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 696
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xff=\\x00N\\x001\\x00j\\x006\\x00x\\x00d\\x00X\\x009\\x00T\\x00q\\x00u\\x00W\\x00h\\x00o\\x00v\\x008\\x00F\\x00x\\x00C\\x00a\\x00n\\x00Z\\x00i\\x008\\x00o\\x000\\x004\\x00%\\x002\\x00f\\x00a\\x002\\x00f\\x00V\\x00c\\x00J\\x00%\\x002\\x00b\\x00s\\x00J\\x004\\x00u\\x00t\\x00o\\x00o\\x00b\\x00k\\x00u\\x00a\\x00t\\x00G\\x00k\\x00K\\x00i\\x00Q\\x00X\\x00j\\x00b\\x002\\x00Z\\x00T\\x005\\x00L\\x00x\\x005\\x00n\\x00H\\x00Q\\x00T\\x00u\\x00f\\x00%\\x002\\x00b\\x003\\x00L\\x00o\\x00%\\x002\\x00f\\x00C\\x00X\\x00J\\x00Q\\x00m\\x00u\\x00o\\x00V\\x00W\\x008\\x00G\\x009\\x00g\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe5\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 697
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae48000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 698
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\x01X\\x00%\\x002\\x00f\\x00x\\x00C\\x00o\\x00H\\x00y\\x006\\x004\\x00S\\x00Q\\x00E\\x00V\\x00n\\x00L\\x00p\\x00w\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe7\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00e\\x003\\x009\\x001\\x002\\x00f\\x001\\x00d\\x00-\\x000\\x006\\x004\\x004\\x00-\\x004\\x00d\\x00a\\x00d\\x00-\\x00b\\x00c\\x00a\\x00c\\x00-\\x00d\\x000\\x008\\x00d\\x009\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 699
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae4a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 700
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\x022\\x00b\\x00C\\x00i\\x00g\\x00Q\\x00v\\x00%\\x002\\x00b\\x004\\x00t\\x00L\\x008\\x00F\\x00F\\x00p\\x00j\\x00F\\x00L\\x00U\\x003\\x00a\\x00G\\x00T\\x00r\\x00%\\x002\\x00f\\x009\\x00V\\x00C\\x007\\x00y\\x00F\\x00C\\x00d\\x00s\\x00D\\x00g\\x00U\\x00%\\x002\\x00f\\x00I\\x00q\\x003\\x009\\x00I\\x009\\x00W\\x008\\x008\\x00h\\x00y\\x004\\x007\\x00y\\x00k\\x00Z\\x001\\x00L\\x00J\\x002\\x00S\\x00X\\x00i\\x00o\\x00z\\x00j\\x00l\\x004\\x00b\\x00s\\x00n\\x00Y\\x00I\\x00s\\x00L\\x00L\\x00j\\x00I\\x00S\\x004\\x00w\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe3\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 701
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae4c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 702
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\x04d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00c\\x006\\x001\\x00e\\x00b\\x003\\x00f\\x007\\x00-\\x00c\\x00d\\x002\\x007\\x00-\\x004\\x004\\x008\\x009\\x00-\\x009\\x004\\x00d\\x007\\x00-\\x00f\\x003\\x002\\x00a\\x00e\\x00a\\x008\\x001\\x00e\\x001\\x003\\x001\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x008\\x009\\x003\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00m\\x00Q\\x000\\x00b\\x00d\\x00P\\x00G\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 703
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae4e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 704
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\x06d\\x00a\\x006\\x001\\x00d\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00R\\x00r\\x00u\\x00j\\x00b\\x00e\\x00c\\x00z\\x00I\\x00a\\x00u\\x00N\\x00n\\x00b\\x00w\\x00d\\x00X\\x00X\\x003\\x00v\\x00Z\\x00x\\x007\\x00K\\x00P\\x00R\\x00c\\x008\\x00o\\x00r\\x00E\\x008\\x00f\\x00o\\x00c\\x00P\\x00W\\x00o\\x004\\x00T\\x00t\\x00O\\x00x\\x00w\\x004\\x00B\\x007\\x00j\\x00n\\x00x\\x00f\\x00I\\x00z\\x00U\\x00G\\x00Y\\x00F\\x00H\\x00o\\x00E\\x00L\\x00a\\x00q\\x001\\x00F\\x00X\\x00N\\x00k\\x00r\\x00D\\x000\\x00l\\x000\\x00D\\x00J\\x00P\\x00m\\x00%\\x002\\x00f\\x00%\\x002\\x00f\\x00e\\x00x\\x00K\\x00X\\x00k\\x00j\\x00Q\\x00%\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 705
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecdf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00100000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 706
          },
          {
            "timestamp": "2026-05-28 22:32:53,918",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecdf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00012000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 707
          },
          {
            "timestamp": "2026-05-28 22:32:53,934",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\x07o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x004\\x00b\\x00e\\x001\\x001\\x004\\x002\\x00b\\x00-\\x00b\\x005\\x000\\x00e\\x00-\\x004\\x007\\x002\\x00e\\x00-\\x008\\x008\\x00a\\x003\\x00-\\x001\\x001\\x007\\x001\\x002\\x000\\x00a\\x00b\\x008\\x001\\x002\\x00f\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00i\\x00H\\x00K\\x00J\\x00C\\x00m\\x00h\\x00B\\x002\\x00p\\x00U\\x00H\\x00m\\x00F\\x00b\\x00Y\\x00n\\x00C\\x00O\\x00n\\x00k\\x00p\\x004\\x00H\\x00L\\x00"
              },
              {
                "name": "Length",
                "value": "57344"
              }
            ],
            "repeated": 0,
            "id": 708
          },
          {
            "timestamp": "2026-05-28 22:32:53,934",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cece02000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 709
          },
          {
            "timestamp": "2026-05-28 22:32:53,934",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\x156\\x00%\\x002\\x00b\\x000\\x00A\\x00B\\x00b\\x00i\\x00W\\x00h\\x00I\\x00Q\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe5\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00d\\x000\\x007\\x007\\x00f\\x00c\\x004\\x002\\x00-\\x00e\\x00d\\x00a\\x002\\x00-\\x004\\x004\\x00a\\x005\\x00-\\x009\\x003\\x00c\\x00a\\x00-\\x002\\x00a\\x00a\\x00c\\x00b\\x008\\x005\\x007\\x004\\x004\\x008\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 710
          },
          {
            "timestamp": "2026-05-28 22:32:53,934",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cece23000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 711
          },
          {
            "timestamp": "2026-05-28 22:32:53,950",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x042C\\x001\\x00b\\x00V\\x00c\\x00k\\x00q\\x00%\\x002\\x00f\\x00x\\x00t\\x003\\x00L\\x00Q\\x00a\\x00A\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xed\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x001\\x00b\\x006\\x00d\\x00c\\x007\\x006\\x00e\\x00-\\x00e\\x00d\\x008\\x008\\x00-\\x004\\x009\\x002\\x004\\x00-\\x008\\x000\\x001\\x003\\x00-\\x00a\\x007\\x00a\\x002\\x00f\\x00a\\x00f\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 712
          },
          {
            "timestamp": "2026-05-28 22:32:53,950",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cece44000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 713
          },
          {
            "timestamp": "2026-05-28 22:32:53,950",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04Om\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x003\\x006\\x003\\x008\\x008\\x00c\\x00b\\x007\\x00-\\x00d\\x00a\\x009\\x007\\x00-\\x004\\x00c\\x009\\x005\\x00-\\x009\\x009\\x00b\\x004\\x00-\\x00f\\x00b\\x004\\x002\\x00f\\x00b\\x007\\x001\\x008\\x00b\\x007\\x004\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00k\\x00c\\x00z\\x00y\\x00P\\x00O\\x00U\\x00N\\x00m\\x007\\x00%\\x002\\x00b\\x00Q\\x00W\\x00%\\x002\\x00b\\x001\\x00A\\x001\\x002\\x00S\\x00x\\x00r\\x00E\\x002\\x00g\\x00S\\x00i\\x00k\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 714
          },
          {
            "timestamp": "2026-05-28 22:32:53,950",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cece65000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 715
          },
          {
            "timestamp": "2026-05-28 22:32:53,950",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04lb\\x00q\\x00K\\x00c\\x00N\\x00V\\x00w\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe7\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x005\\x00d\\x00e\\x00d\\x005\\x000\\x007\\x00d\\x00-\\x00c\\x005\\x001\\x00d\\x00-\\x004\\x001\\x003\\x00e\\x00-\\x00a\\x000\\x002\\x008\\x00-\\x00a\\x00a\\x00f\\x008\\x00f\\x00b\\x001\\x00e\\x000\\x009\\x00f\\x005\\x00?\\x00P\\x001\\x00=\\x001\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 716
          },
          {
            "timestamp": "2026-05-28 22:32:53,950",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cece86000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 717
          },
          {
            "timestamp": "2026-05-28 22:32:53,965",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\x890\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00H\\x00m\\x00d\\x00w\\x00a\\x00s\\x00e\\x007\\x00%\\x002\\x00b\\x00l\\x00S\\x00V\\x006\\x001\\x00P\\x00a\\x00p\\x00m\\x00J\\x00u\\x00c\\x00C\\x007\\x005\\x00x\\x007\\x000\\x001\\x005\\x008\\x004\\x00e\\x00i\\x00E\\x00U\\x00y\\x00U\\x008\\x00w\\x00T\\x003\\x00e\\x00y\\x00K\\x00i\\x00S\\x00u\\x00K\\x00y\\x00a\\x00q\\x00o\\x00R\\x007\\x000\\x00p\\x00r\\x00V\\x00K\\x005\\x00o\\x00%\\x002\\x00b\\x00x\\x00N\\x00f\\x004\\x006\\x007\\x00J\\x00R\\x00D\\x00s\\x003\\x00b\\x00H\\x00N\\x00W\\x00E\\x009\\x00L\\x00c\\x008\\x00Q\\x00n\\x004\\x00Q\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xeb\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 718
          },
          {
            "timestamp": "2026-05-28 22:32:53,965",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecea7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 719
          },
          {
            "timestamp": "2026-05-28 22:32:53,965",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\xa6A\\x00O\\x001\\x00%\\x002\\x00f\\x00u\\x00n\\x00O\\x00U\\x00x\\x00H\\x00Z\\x00g\\x00z\\x00m\\x00B\\x008\\x004\\x00K\\x00p\\x00L\\x00k\\x00n\\x00Y\\x001\\x00%\\x002\\x00f\\x00J\\x00a\\x00u\\x00y\\x00b\\x00I\\x00%\\x002\\x00f\\x00E\\x00l\\x00J\\x00Y\\x00y\\x00c\\x00w\\x00P\\x00D\\x00m\\x00b\\x00P\\x00R\\x00c\\x00V\\x00I\\x00D\\x00j\\x00V\\x00B\\x005\\x00K\\x007\\x00i\\x00u\\x00H\\x008\\x00f\\x00A\\x00a\\x00t\\x00n\\x00W\\x002\\x009\\x00j\\x00R\\x00B\\x00m\\x00h\\x00W\\x00o\\x00X\\x00G\\x00v\\x00Q\\x00Q\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe7\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 720
          },
          {
            "timestamp": "2026-05-28 22:32:53,965",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecec8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 721
          },
          {
            "timestamp": "2026-05-28 22:32:53,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\xc3j\\x00P\\x00b\\x009\\x00W\\x00J\\x00Q\\x00l\\x00Q\\x00M\\x00j\\x00f\\x006\\x008\\x00i\\x00j\\x00v\\x00H\\x000\\x00X\\x00p\\x00u\\x00L\\x00Q\\x00X\\x00F\\x00b\\x00C\\x00Q\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe5\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00b\\x003\\x00e\\x003\\x002\\x005\\x00c\\x00c\\x00-\\x007\\x00d\\x009\\x00d\\x00-\\x004\\x00c\\x007\\x00d\\x00-\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 722
          },
          {
            "timestamp": "2026-05-28 22:32:53,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecef0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00200000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 723
          },
          {
            "timestamp": "2026-05-28 22:32:53,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecef0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00022000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 724
          },
          {
            "timestamp": "2026-05-28 22:32:53,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\xe0.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x003\\x000\\x009\\x004\\x005\\x008\\x007\\x009\\x00-\\x003\\x004\\x002\\x008\\x00-\\x004\\x007\\x00e\\x00e\\x00-\\x008\\x004\\x003\\x00f\\x00-\\x00f\\x006\\x004\\x00e\\x006\\x00b\\x005\\x005\\x009\\x008\\x006\\x000\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00Y\\x00o\\x00X\\x00"
              },
              {
                "name": "Length",
                "value": "118784"
              }
            ],
            "repeated": 0,
            "id": 725
          },
          {
            "timestamp": "2026-05-28 22:32:53,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecf12000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 726
          },
          {
            "timestamp": "2026-05-28 22:32:53,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecf51000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 727
          },
          {
            "timestamp": "2026-05-28 22:32:53,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x04\\xfdo\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x000\\x007\\x00d\\x004\\x009\\x00f\\x009\\x007\\x00-\\x006\\x002\\x00c\\x006\\x00-\\x004\\x005\\x000\\x00a\\x00-\\x00a\\x005\\x00d\\x00b\\x00-\\x006\\x005\\x004\\x00f\\x00a\\x00c\\x003\\x00b\\x009\\x008\\x00d\\x007\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00f\\x00z\\x00h\\x00L\\x00I\\x00u\\x00H\\x005\\x00V\\x00X\\x005\\x00h\\x00K\\x00f\\x00O\\x00s\\x007\\x00K\\x006\\x00Q\\x00g\\x00O\\x00r\\x00x\\x006\\x00"
              },
              {
                "name": "Length",
                "value": "245760"
              }
            ],
            "repeated": 0,
            "id": 728
          },
          {
            "timestamp": "2026-05-28 22:32:53,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecf55000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 729
          },
          {
            "timestamp": "2026-05-28 22:32:53,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecf93000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 730
          },
          {
            "timestamp": "2026-05-28 22:32:54,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x059g\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe7\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x004\\x006\\x005\\x000\\x009\\x002\\x00c\\x000\\x00-\\x009\\x000\\x009\\x003\\x00-\\x004\\x000\\x001\\x001\\x00-\\x00b\\x005\\x00f\\x009\\x00-\\x00e\\x005\\x00d\\x00f\\x00f\\x00f\\x005\\x00c\\x001\\x004\\x00c\\x00e\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x00"
              },
              {
                "name": "Length",
                "value": "245760"
              }
            ],
            "repeated": 0,
            "id": 731
          },
          {
            "timestamp": "2026-05-28 22:32:54,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecf98000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 732
          },
          {
            "timestamp": "2026-05-28 22:32:54,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecfd5000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 733
          },
          {
            "timestamp": "2026-05-28 22:32:54,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x05uI\\x00e\\x00D\\x003\\x00f\\x00Q\\x00w\\x00x\\x00v\\x00M\\x00N\\x00k\\x005\\x00R\\x003\\x00u\\x00d\\x00p\\x00Q\\x00l\\x00O\\x001\\x00%\\x002\\x00f\\x00w\\x00D\\x00t\\x009\\x008\\x00%\\x002\\x00b\\x00x\\x001\\x00v\\x00D\\x00%\\x002\\x00f\\x00h\\x00k\\x00%\\x002\\x00b\\x008\\x00Y\\x00Y\\x001\\x00j\\x00C\\x002\\x00t\\x00Q\\x00x\\x00p\\x00i\\x008\\x00s\\x00C\\x00B\\x00J\\x00z\\x00D\\x00m\\x00K\\x00F\\x00K\\x00N\\x002\\x00f\\x00%\\x002\\x00b\\x00t\\x00l\\x00L\\x00q\\x00i\\x00i\\x00k\\x000\\x00g\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe5\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00"
              },
              {
                "name": "Length",
                "value": "245760"
              }
            ],
            "repeated": 0,
            "id": 734
          },
          {
            "timestamp": "2026-05-28 22:32:54,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecfdb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 735
          },
          {
            "timestamp": "2026-05-28 22:32:54,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced017000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 736
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865a95",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x05\\xb12\\x00b\\x00v\\x00I\\x00F\\x009\\x00b\\x00H\\x00N\\x007\\x00s\\x00O\\x00m\\x00w\\x00k\\x008\\x00j\\x00k\\x00r\\x00E\\x00X\\x00n\\x00J\\x00Z\\x00r\\x00p\\x00c\\x00g\\x006\\x002\\x00g\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\xe7\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x006\\x002\\x006\\x003\\x00a\\x003\\x00a\\x00d\\x00-\\x002\\x001\\x009\\x001\\x00-\\x004\\x007\\x007\\x00"
              },
              {
                "name": "Length",
                "value": "2318336"
              }
            ],
            "repeated": 0,
            "id": 737
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b3c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 738
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b3c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 739
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b3c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 740
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b3c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 741
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b78",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 742
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b78",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 743
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b78",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 744
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865b78",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 745
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bb4",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 746
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bb4",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 747
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bb4",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 748
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bb4",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 749
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bf0",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 750
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bf0",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 751
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bf0",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 752
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865bf0",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 753
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c2c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 754
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c2c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 755
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c2c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 756
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c2c",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 757
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c68",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 758
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c68",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 759
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c68",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 760
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4865c68",
            "parentcaller": "0x7ff6d481adfa",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 761
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d47e1927",
            "parentcaller": "0x7ff6d47cd3fd",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "FlsGetValue"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96520fa0"
              }
            ],
            "repeated": 0,
            "id": 762
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd102",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 763
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd102",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced01e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 764
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd102",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced02f000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 765
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 766
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000284"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 767
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              },
              {
                "name": "ValueName",
                "value": "DecisionEnginePatch"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch"
              }
            ],
            "repeated": 0,
            "id": 768
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 769
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 770
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 771
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 772
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              },
              {
                "name": "ValueName",
                "value": "DecisionEnginePatch"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch"
              }
            ],
            "repeated": 0,
            "id": 773
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 774
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 775
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 776
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000284"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 777
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              },
              {
                "name": "ValueName",
                "value": "DecisionEnginePatch"
              },
              {
                "name": "Data",
                "value": "{\"tables\":[{\"name\":\"System Wake Allowed\",\"rules\":[{\"checks\":[[\"Policy active hours restricted\",\"=\",true]],\"result\":true},{\"checks\":[[\"Policy Scheduled Install\",\"=\",true]],\"result\":true},{\"checks\":[],\"result\":false}]},{\"name\":\"System Enable Prehibernate Wak"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch"
              }
            ],
            "repeated": 0,
            "id": 778
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 779
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd102",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced03b000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 780
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 781
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000284"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 782
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              },
              {
                "name": "ValueName",
                "value": "DecisionEngine"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEngine"
              }
            ],
            "repeated": 0,
            "id": 783
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000284"
              }
            ],
            "repeated": 0,
            "id": 784
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47cd102",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced047000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 785
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 786
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "UPShared.dll"
              }
            ],
            "repeated": 0,
            "id": 787
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\upshared.dll"
              }
            ],
            "repeated": 0,
            "id": 788
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\upshared.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 789
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\upshared.dll"
              }
            ],
            "repeated": 0,
            "id": 790
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff392b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000b2000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 791
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3935e000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 792
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3932f000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 793
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3932f000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 794
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3932f000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 795
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3932f000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 796
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3932e000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 797
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "WINHTTP.dll"
              }
            ],
            "repeated": 0,
            "id": 798
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 799
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 800
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winhttp.dll"
              }
            ],
            "repeated": 0,
            "id": 801
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winhttp.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 802
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winhttp.dll"
              }
            ],
            "repeated": 0,
            "id": 803
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90780000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0010a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 804
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90880000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 805
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90855000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 806
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90855000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 807
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90855000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 808
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90855000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 809
          },
          {
            "timestamp": "2026-05-28 22:32:54,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90855000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 810
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 811
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 812
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "DPAPI.DLL"
              }
            ],
            "repeated": 0,
            "id": 813
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90855000"
              },
              {
                "name": "ModuleName",
                "value": "WINHTTP.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 814
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dpapi.dll"
              }
            ],
            "repeated": 0,
            "id": 815
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dpapi.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 816
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000033c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\dpapi.dll"
              }
            ],
            "repeated": 0,
            "id": 817
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000340"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 818
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b7000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 819
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b3000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 820
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b3000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 821
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b3000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 822
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b3000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 823
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b3000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 824
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 825
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000033c"
              }
            ],
            "repeated": 0,
            "id": 826
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3932e000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 827
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\r\\x00\\x00\\x00\\x0c\\x00\\x00\\x00\\x02\\x00\\x00\\x00g\\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00 \\x00 \\x00 \\x00\\x02\\x00\\x00\\x00\"\\x00r\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\"\\x00 \\x00:\\x00 \\x00\\x02\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00 \\x00{\\x00\n\\x00\\x02\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00 \\x00 \\x00 \\x00\\x02\\x00\\x00\\x00h\\x00e\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00:\\x00 \\x00[\\x00\\x02\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\x00 \\x00 \\x00 \\x00\\x02\\x00\\x00\\x00 \\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x00d\\x00a\\x00t\\x00\\x02\\x00\\x00\\x00h\\x00i\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00o\\x00w\\x00n\\x00l\\x00\\x02\\x00\\x00\\x00d\\x00 \\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00r\\x00i\\x00t\\x00y\\x00\\x02\\x00\\x00\\x00 \\x00\"\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00t\\x00r\\x00u\\x00e\\x00"
              }
            ],
            "repeated": 0,
            "id": 828
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b3000"
              },
              {
                "name": "ModuleName",
                "value": "DPAPI.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 829
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WINHTTP"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90780000"
              }
            ],
            "repeated": 0,
            "id": 830
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 9,
            "id": 831
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\DPAPI"
              },
              {
                "name": "DllBase",
                "value": "0x7fff960b0000"
              }
            ],
            "repeated": 0,
            "id": 832
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\UPShared"
              },
              {
                "name": "DllBase",
                "value": "0x7fff392b0000"
              }
            ],
            "repeated": 0,
            "id": 833
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "0",
                "pretty_value": "FILE_SUPERSEDE"
              }
            ],
            "repeated": 0,
            "id": 834
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              }
            ],
            "repeated": 0,
            "id": 835
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\winhttp"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90780000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff907ce130"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 836
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\dpapi"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff960b0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff960b1850"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 837
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "api-ms-win-core-synch-l1-2-0.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              }
            ],
            "repeated": 0,
            "id": 838
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "InitializeConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb9f40"
              }
            ],
            "repeated": 0,
            "id": 839
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "SleepConditionVariableCS"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff96543890"
              }
            ],
            "repeated": 0,
            "id": 840
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNELBASE.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff964d0000"
              },
              {
                "name": "FunctionName",
                "value": "WakeAllConditionVariable"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca5430"
              }
            ],
            "repeated": 0,
            "id": 841
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\upshared"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff392b0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff393205a0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 842
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 843
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0e4c",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 844
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d481bfe8",
            "parentcaller": "0x7ff6d48179d5",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced053000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 845
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831a0f",
            "parentcaller": "0x7ff6d4817a65",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3935e000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 846
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831a0f",
            "parentcaller": "0x7ff6d4817a65",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3935e000"
              },
              {
                "name": "ModuleName",
                "value": "UPShared.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 847
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831a0f",
            "parentcaller": "0x7ff6d4817a65",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 848
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831a0f",
            "parentcaller": "0x7ff6d4817a65",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98198000"
              },
              {
                "name": "ModuleName",
                "value": "OLEAUT32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 849
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831d15",
            "parentcaller": "0x7ff6d4817b08",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae59000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 850
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831d15",
            "parentcaller": "0x7ff6d4817b08",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecee9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 851
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831d15",
            "parentcaller": "0x7ff6d4817b08",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced05f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 852
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831d15",
            "parentcaller": "0x7ff6d4817b08",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced064000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 853
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831d15",
            "parentcaller": "0x7ff6d4817b08",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced069000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 854
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831d15",
            "parentcaller": "0x7ff6d4817b08",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced06e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 855
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4831d83",
            "parentcaller": "0x7ff6d4817b08",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced073000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 856
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d4806663",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced078000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 857
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d4806680",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced07b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 858
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d48066c7",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced07e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 859
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced019000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 860
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced034000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 861
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced057000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 862
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced04c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 863
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced070000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 864
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced041000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 865
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae55000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 866
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecee4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 867
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced054000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 868
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced047000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 869
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae59000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 870
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecee1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 871
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47cfffa",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 872
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d47ccfe8",
            "parentcaller": "0x7ff6d47d006a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced034000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 873
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4841193",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\TestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\TestHooks"
              }
            ],
            "repeated": 0,
            "id": 874
          },
          {
            "timestamp": "2026-05-28 22:32:54,137",
            "thread_id": "12624",
            "caller": "0x7ff6d484c04c",
            "parentcaller": "0x7ff6d4873041",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wuapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff80ca0000"
              }
            ],
            "repeated": 0,
            "id": 875
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d484c04c",
            "parentcaller": "0x7ff6d4873041",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wuapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80ca0000"
              }
            ],
            "repeated": 0,
            "id": 876
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d484c04c",
            "parentcaller": "0x7ff6d4873041",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wups"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93940000"
              }
            ],
            "repeated": 0,
            "id": 877
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d484c04c",
            "parentcaller": "0x7ff6d4873041",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "wups.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93940000"
              }
            ],
            "repeated": 0,
            "id": 878
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d484c04c",
            "parentcaller": "0x7ff6d4873041",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "unload"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wups"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93940000"
              }
            ],
            "repeated": 0,
            "id": 879
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d484c04c",
            "parentcaller": "0x7ff6d4873041",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "4CB43D7F-7EEE-4906-8698-60DA1C38F2FE"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "918EFD1E-B5D8-4C90-8540-AEB9BDC56F9D"
              },
              {
                "name": "ProgID",
                "value": "Microsoft.Update.Session.1"
              }
            ],
            "repeated": 0,
            "id": 880
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48730c0",
            "parentcaller": "0x7ff6d481ba30",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80d76000"
              },
              {
                "name": "ModuleName",
                "value": "wuapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 881
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48730c0",
            "parentcaller": "0x7ff6d481ba30",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80d76000"
              },
              {
                "name": "ModuleName",
                "value": "wuapi.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 882
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 883
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "wtsapi32.dll"
              }
            ],
            "repeated": 0,
            "id": 884
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wtsapi32.dll"
              }
            ],
            "repeated": 0,
            "id": 885
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wtsapi32.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 886
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000350"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wtsapi32.dll"
              }
            ],
            "repeated": 0,
            "id": 887
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000350"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91fe0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x00014000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 888
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91ff1000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 889
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91feb000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 890
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91feb000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 891
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91feb000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 892
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91feb000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 893
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91feb000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 894
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 895
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 896
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91feb000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 897
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\wtsapi32"
              },
              {
                "name": "DllBase",
                "value": "0x7fff91fe0000"
              }
            ],
            "repeated": 0,
            "id": 898
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 899
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\wtsapi32"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91fe0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff91fe28c0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 900
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 901
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d18b2",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 902
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 903
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "WINSTA.dll"
              }
            ],
            "repeated": 0,
            "id": 904
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              }
            ],
            "repeated": 0,
            "id": 905
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 906
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000334"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000034c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\winsta.dll"
              }
            ],
            "repeated": 0,
            "id": 907
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000334"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ff0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0005b000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 908
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96048000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 909
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9602a000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 910
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9602a000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 911
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9602a000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 912
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9602a000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 913
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96029000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 914
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              }
            ],
            "repeated": 0,
            "id": 915
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000034c"
              }
            ],
            "repeated": 0,
            "id": 916
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96029000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00002000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 917
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WINSTA"
              },
              {
                "name": "DllBase",
                "value": "0x7fff95ff0000"
              }
            ],
            "repeated": 0,
            "id": 918
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\winsta"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95ff0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff95ffb910"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 919
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91ff1000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 920
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91ff1000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 921
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96048000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 922
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96048000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 923
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 924
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98c50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "ntdll.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 925
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetSuiteMask"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c8cc10"
              }
            ],
            "repeated": 0,
            "id": 926
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96048000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 927
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff96048000"
              },
              {
                "name": "ModuleName",
                "value": "WINSTA.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 928
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "synchronization",
            "api": "NtOpenEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "EventName",
                "value": "Global\\TermSrvReadyEvent"
              }
            ],
            "repeated": 0,
            "id": 929
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 930
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48308aa",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 931
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d1733",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 932
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d1733",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 933
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d483094a",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 934
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d483094a",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91ff1000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 935
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d483094a",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff91ff1000"
              },
              {
                "name": "ModuleName",
                "value": "wtsapi32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 936
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d483094a",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 937
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d483094a",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 938
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d1827",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 939
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d1827",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 940
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830993",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 941
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830993",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "12"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 942
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830993",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 943
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830993",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 5,
            "id": 944
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 945
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 946
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 947
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 948
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 949
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 950
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 951
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 952
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 953
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 954
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48309ff",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 955
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830a98",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 956
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830ac0",
            "parentcaller": "0x7ff6d48787cf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 957
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830ac0",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 958
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4830ac0",
            "parentcaller": "0x7ff6d48787cf",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000334"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 959
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48787e6",
            "parentcaller": "0x7ff6d48730d8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "8"
              },
              {
                "name": "TokenInformation",
                "value": "\\x01\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 960
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48787e6",
            "parentcaller": "0x7ff6d48730d8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000340"
              }
            ],
            "repeated": 0,
            "id": 961
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4878846",
            "parentcaller": "0x7ff6d48730d8",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              }
            ],
            "repeated": 0,
            "id": 962
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d489b7d0",
            "parentcaller": "0x7ff6d481bbfd",
            "category": "synchronization",
            "api": "NtCreateEvent",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000344"
              },
              {
                "name": "EventName",
                "value": "Global\\LegacyUOProviderWorkCompleted"
              },
              {
                "name": "EventType",
                "value": "1"
              },
              {
                "name": "InitialState",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 963
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4821223",
            "parentcaller": "0x7ff6d481894e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler"
              }
            ],
            "repeated": 0,
            "id": 964
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4821287",
            "parentcaller": "0x7ff6d481894e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000350"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "3"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "16"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 965
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4821333",
            "parentcaller": "0x7ff6d481894e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "ia"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 966
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4821333",
            "parentcaller": "0x7ff6d481894e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "officeclicktorun"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun"
              }
            ],
            "repeated": 0,
            "id": 967
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4821333",
            "parentcaller": "0x7ff6d481894e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "uso"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso"
              }
            ],
            "repeated": 0,
            "id": 968
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4821453",
            "parentcaller": "0x7ff6d481894e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 969
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 970
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "isV2Provider"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\isV2Provider"
              }
            ],
            "repeated": 0,
            "id": 971
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 972
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun"
              }
            ],
            "repeated": 0,
            "id": 973
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "isV2Provider"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun\\isV2Provider"
              }
            ],
            "repeated": 0,
            "id": 974
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 975
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso"
              },
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso"
              }
            ],
            "repeated": 0,
            "id": 976
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "ValueName",
                "value": "isV2Provider"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso\\isV2Provider"
              }
            ],
            "repeated": 0,
            "id": 977
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 978
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47c1f7e",
            "parentcaller": "0x7ff6d47c2e2b",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 979
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47bf77f",
            "parentcaller": "0x7ff6d47c2489",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 980
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47c2506",
            "parentcaller": "0x7ff6d47c1fc7",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 981
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47c0145",
            "parentcaller": "0x7ff6d47c26d5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 982
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47bde0b",
            "parentcaller": "0x7ff6d47cea2e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 983
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47c61a5",
            "parentcaller": "0x7ff6d47c22eb",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8032:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 984
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47bf48a",
            "parentcaller": "0x7ff6d47c61db",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 985
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47be18d",
            "parentcaller": "0x7ff6d47be3e1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 986
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47be18d",
            "parentcaller": "0x7ff6d47be3e1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 987
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47be18d",
            "parentcaller": "0x7ff6d47be45d",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 988
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47be18d",
            "parentcaller": "0x7ff6d47be45d",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 989
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47bdc1b",
            "parentcaller": "0x7ff6d47be490",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 990
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47bdc1b",
            "parentcaller": "0x7ff6d47be4be",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 991
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47bdc53",
            "parentcaller": "0x7ff6d47c6230",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 992
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d47bdc1b",
            "parentcaller": "0x7ff6d47c623e",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000350"
              }
            ],
            "repeated": 0,
            "id": 993
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 994
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 995
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 996
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 997
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d486626b",
            "parentcaller": "0x7ff6d47f2bfc",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 998
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d486626b",
            "parentcaller": "0x7ff6d47f2bfc",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 999
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d486626b",
            "parentcaller": "0x7ff6d47f2bfc",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 1000
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d486626b",
            "parentcaller": "0x7ff6d47f2bfc",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1001
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867300",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 1002
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867300",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1003
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867300",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 1004
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867300",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1005
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867300",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae55000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1006
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d486b2a0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced041000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1007
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced070000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1008
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced04c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1009
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced057000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1010
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867529",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e1000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1011
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867529",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1012
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867529",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1013
          },
          {
            "timestamp": "2026-05-28 22:32:54,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4867529",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cecee1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1014
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4867529",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x18-\\x00s\\x00p\\x00e\\x00c\\x00i\\x00f\\x00i\\x00c\\x00 \\x00s\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00-\\x00r\\x00e\\x00l\\x00a\\x00t\\x00e\\x00d\\x00 \\x00v\\x00u\\x00l\\x00n\\x00e\\x00r\\x00a\\x00b\\x00i\\x00l\\x00i\\x00t\\x00y\\x00.\\x00 \\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00 \\x00v\\x00u\\x00l\\x00n\\x00e\\x00r\\x00a\\x00b\\x00i\\x00l\\x00i\\x00t\\x00i\\x00e\\x00s\\x00 \\x00a\\x00r\\x00e\\x00 \\x00r\\x00a\\x00t\\x00e\\x00d\\x00 \\x00b\\x00a\\x00s\\x00e\\x00d\\x00 \\x00o\\x00n\\x00 \\x00t\\x00h\\x00e\\x00i\\x00r\\x00 \\x00s\\x00e\\x00v\\x00e\\x00r\\x00i\\x00t\\x00y\\x00 \\x00w\\x00h\\x00i\\x00c\\x00h\\x00 \\x00i\\x00s\\x00 \\x00i\\x00n\\x00d\\x00i\\x00c\\x00a\\x00t\\x00e\\x00d\\x00 \\x00i\\x00n\\x00 \\x00t\\x00h\\x00e\\x00"
              },
              {
                "name": "Length",
                "value": "4001792"
              }
            ],
            "repeated": 0,
            "id": 1015
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d486b2a0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d6000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1016
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d486b2a0",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1017
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d486b2a0",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced8b5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1018
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced8c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e0000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1019
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced8c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1020
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedc9f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1021
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d47ee07b",
            "parentcaller": "0x7ff6d48674cc",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d6000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1022
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4867529",
            "parentcaller": "0x7ff6d47ee53a",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e1000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1023
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced019000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1024
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d2000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1025
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d47f401d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 1026
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d47ee07b",
            "parentcaller": "0x7ff6d47f359b",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced8c0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e0000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 1027
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d48755c1",
            "parentcaller": "0x7ff6d47d0566",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B52AB030-8EF5-4621-B480-4D20975D1D26"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "84DB9AFD-0DDB-424D-A25D-5BC47C4451D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1028
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 1029
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 1030
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 1031
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 1032
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 1033
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 1034
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 1035
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 1036
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 1037
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 1038
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 1039
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 1040
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 1041
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 1042
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 1043
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1044
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              }
            ],
            "repeated": 0,
            "id": 1045
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 1,
            "id": 1046
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              }
            ],
            "repeated": 1,
            "id": 1047
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 1,
            "id": 1048
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000360"
              }
            ],
            "repeated": 1,
            "id": 1049
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 0,
            "id": 1050
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1051
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "Pc\\x06\\xed\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1052
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "1"
              },
              {
                "name": "TokenInformation",
                "value": "`\\xc0O\\xa4?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x8c\\x01\\x00\\x00\\x02\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00}\\xd4\\xf6\\x7f\\x00\\x00\\x00\\x00{\\xd4\\xf6\\x7f\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00 \\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1053
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000364"
              },
              {
                "name": "DesiredAccess",
                "value": "0x02000000",
                "pretty_value": "MAXIMUM_ALLOWED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\USER\\S-1-5-18"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_CURRENT_USER"
              }
            ],
            "repeated": 0,
            "id": 1054
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000364"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Control Panel\\International"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International"
              }
            ],
            "repeated": 0,
            "id": 1055
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              }
            ],
            "repeated": 0,
            "id": 1056
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "LocaleName"
              },
              {
                "name": "ValueBuffer",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\LocaleName"
              }
            ],
            "repeated": 0,
            "id": 1057
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sList"
              },
              {
                "name": "ValueBuffer",
                "value": ","
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sList"
              }
            ],
            "repeated": 0,
            "id": 1058
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sDecimal"
              },
              {
                "name": "ValueBuffer",
                "value": "."
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sDecimal"
              }
            ],
            "repeated": 0,
            "id": 1059
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sThousand"
              },
              {
                "name": "ValueBuffer",
                "value": ","
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sThousand"
              }
            ],
            "repeated": 0,
            "id": 1060
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sGrouping"
              },
              {
                "name": "ValueBuffer",
                "value": "3;0"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sGrouping"
              }
            ],
            "repeated": 0,
            "id": 1061
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sNativeDigits"
              },
              {
                "name": "ValueBuffer",
                "value": "0123456789"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sNativeDigits"
              }
            ],
            "repeated": 0,
            "id": 1062
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sMonDecimalSep"
              },
              {
                "name": "ValueBuffer",
                "value": "."
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonDecimalSep"
              }
            ],
            "repeated": 0,
            "id": 1063
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sMonThousandSep"
              },
              {
                "name": "ValueBuffer",
                "value": ","
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonThousandSep"
              }
            ],
            "repeated": 0,
            "id": 1064
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sMonGrouping"
              },
              {
                "name": "ValueBuffer",
                "value": "3;0"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonGrouping"
              }
            ],
            "repeated": 0,
            "id": 1065
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sPositiveSign"
              },
              {
                "name": "ValueBuffer",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sPositiveSign"
              }
            ],
            "repeated": 0,
            "id": 1066
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sNegativeSign"
              },
              {
                "name": "ValueBuffer",
                "value": "-"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sNegativeSign"
              }
            ],
            "repeated": 0,
            "id": 1067
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sTimeFormat"
              },
              {
                "name": "ValueBuffer",
                "value": "h:mm:ss tt"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sTimeFormat"
              }
            ],
            "repeated": 0,
            "id": 1068
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sShortTime"
              },
              {
                "name": "ValueBuffer",
                "value": "h:mm tt"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sShortTime"
              }
            ],
            "repeated": 0,
            "id": 1069
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "s1159"
              },
              {
                "name": "ValueBuffer",
                "value": "AM"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\s1159"
              }
            ],
            "repeated": 0,
            "id": 1070
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "s2359"
              },
              {
                "name": "ValueBuffer",
                "value": "PM"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\s2359"
              }
            ],
            "repeated": 0,
            "id": 1071
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sShortDate"
              },
              {
                "name": "ValueBuffer",
                "value": "d/MM/yyyy"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sShortDate"
              }
            ],
            "repeated": 0,
            "id": 1072
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sYearMonth"
              },
              {
                "name": "ValueBuffer",
                "value": "MMMM yyyy"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sYearMonth"
              }
            ],
            "repeated": 0,
            "id": 1073
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sLongDate"
              },
              {
                "name": "ValueBuffer",
                "value": "dddd, d MMMM yyyy"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sLongDate"
              }
            ],
            "repeated": 0,
            "id": 1074
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iCountry"
              },
              {
                "name": "ValueBuffer",
                "value": "61"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCountry"
              }
            ],
            "repeated": 0,
            "id": 1075
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iMeasure"
              },
              {
                "name": "ValueBuffer",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iMeasure"
              }
            ],
            "repeated": 0,
            "id": 1076
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iPaperSize"
              },
              {
                "name": "ValueBuffer",
                "value": "9"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iPaperSize"
              }
            ],
            "repeated": 0,
            "id": 1077
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iDigits"
              },
              {
                "name": "ValueBuffer",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iDigits"
              }
            ],
            "repeated": 0,
            "id": 1078
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iLZero"
              },
              {
                "name": "ValueBuffer",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iLZero"
              }
            ],
            "repeated": 0,
            "id": 1079
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iNegNumber"
              },
              {
                "name": "ValueBuffer",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iNegNumber"
              }
            ],
            "repeated": 0,
            "id": 1080
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "NumShape"
              },
              {
                "name": "ValueBuffer",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\NumShape"
              }
            ],
            "repeated": 0,
            "id": 1081
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iCurrDigits"
              },
              {
                "name": "ValueBuffer",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCurrDigits"
              }
            ],
            "repeated": 0,
            "id": 1082
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iCurrency"
              },
              {
                "name": "ValueBuffer",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCurrency"
              }
            ],
            "repeated": 0,
            "id": 1083
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iNegCurr"
              },
              {
                "name": "ValueBuffer",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iNegCurr"
              }
            ],
            "repeated": 0,
            "id": 1084
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iFirstDayOfWeek"
              },
              {
                "name": "ValueBuffer",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iFirstDayOfWeek"
              }
            ],
            "repeated": 0,
            "id": 1085
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryMultipleValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iFirstWeekOfYear"
              },
              {
                "name": "ValueBuffer",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iFirstWeekOfYear"
              }
            ],
            "repeated": 0,
            "id": 1086
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "sCurrency"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "$"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sCurrency"
              }
            ],
            "repeated": 0,
            "id": 1087
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000360"
              },
              {
                "name": "ValueName",
                "value": "iCalendarType"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCalendarType"
              }
            ],
            "repeated": 0,
            "id": 1088
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000360"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d"
              }
            ],
            "repeated": 0,
            "id": 1089
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "Currencies"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Currencies"
              }
            ],
            "repeated": 0,
            "id": 1090
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "Calendar"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "Gregorian"
              },
              {
                "name": "FullName",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Calendar"
              }
            ],
            "repeated": 0,
            "id": 1091
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtOpenKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000368"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Gregorian"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Gregorian"
              }
            ],
            "repeated": 0,
            "id": 1092
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 1093
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 1094
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 1095
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 1096
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 1097
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 1098
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 1099
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000084"
              },
              {
                "name": "ValueName",
                "value": "000603xx"
              },
              {
                "name": "Type",
                "value": "1",
                "pretty_value": "REG_SZ"
              },
              {
                "name": "Information",
                "value": "kernel32.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx"
              }
            ],
            "repeated": 0,
            "id": 1100
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "kernel32.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff98b50000"
              }
            ],
            "repeated": 0,
            "id": 1101
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff98b50000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "kernel32.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 1102
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortGetHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b5a190"
              }
            ],
            "repeated": 0,
            "id": 1103
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "KERNEL32.DLL"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98b50000"
              },
              {
                "name": "FunctionName",
                "value": "SortCloseHandle"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98b70170"
              }
            ],
            "repeated": 0,
            "id": 1104
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "1",
                "pretty_value": "FILE_SHARE_READ"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "yes"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1105
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000036c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x000f0005",
                "pretty_value": "STANDARD_RIGHTS_REQUIRED|SECTION_QUERY|SECTION_MAP_READ"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000368"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\Globalization\\Sorting\\SortDefault.nls"
              }
            ],
            "repeated": 0,
            "id": 1106
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000036c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4d0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x3fa44fc2b0"
              },
              {
                "name": "ViewSize",
                "value": "0x00338000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1107
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1108
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000368"
              }
            ],
            "repeated": 0,
            "id": 1109
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids"
              }
            ],
            "repeated": 0,
            "id": 1110
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "en-AU"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU"
              }
            ],
            "repeated": 0,
            "id": 1111
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 1112
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1113
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1114
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1115
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1116
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 1117
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1118
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1119
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1120
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1121
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1122
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1123
          },
          {
            "timestamp": "2026-05-28 22:32:54,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1124
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1125
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1126
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1127
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1128
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1129
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1130
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1131
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1132
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1133
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1134
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1135
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1136
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1137
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1138
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1139
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1140
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1141
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1142
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1143
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1144
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1145
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1146
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1147
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1148
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1149
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1150
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1151
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1152
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1153
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1154
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1155
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1156
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1157
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1158
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1159
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1160
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1161
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1162
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1163
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1164
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1165
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1166
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1167
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1168
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1169
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1170
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1171
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1172
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1173
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1174
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1175
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1176
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1177
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1178
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1179
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1180
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1181
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1182
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1183
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1184
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1185
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1186
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1187
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1188
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1189
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1190
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1191
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1192
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1193
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1194
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1195
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1196
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1197
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1198
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1199
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1200
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1201
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1202
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1203
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1204
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1205
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1206
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1207
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1208
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1209
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1210
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1211
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1212
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1213
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1214
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1215
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1216
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1217
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1218
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1219
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1220
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1221
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1222
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1223
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1224
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1225
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1226
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1227
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1228
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1229
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1230
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1231
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1232
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1233
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1234
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1235
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1236
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1237
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1238
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1239
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1240
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1241
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1242
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1243
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1244
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1245
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1246
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1247
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1248
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1249
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1250
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1251
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1252
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1253
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1254
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1255
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1256
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1257
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1258
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1259
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1260
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1261
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1262
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1263
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1264
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1265
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1266
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1267
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1268
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1269
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1270
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1271
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1272
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1273
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1274
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1275
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1276
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1277
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1278
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1279
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1280
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1281
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1282
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1283
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1284
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1285
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1286
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1287
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1288
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1289
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1290
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1291
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1292
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1293
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1294
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1295
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1296
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1297
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1298
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1299
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1300
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1301
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1302
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1303
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1304
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1305
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1306
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1307
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1308
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1309
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1310
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1311
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1312
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1313
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1314
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1315
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1316
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1317
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1318
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1319
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1320
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1321
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1322
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1323
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1324
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1325
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1326
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1327
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1328
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1329
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1330
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1331
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1332
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceae59000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1333
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1334
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1335
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1336
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1337
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1338
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1339
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1340
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1341
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1342
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1343
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1344
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1345
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1346
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1347
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1348
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1349
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1350
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1351
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1352
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1353
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1354
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1355
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1356
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1357
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1358
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1359
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1360
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1361
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1362
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1363
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1364
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1365
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1366
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1367
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1368
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1369
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1370
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1371
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1372
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1373
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1374
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1375
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1376
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1377
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1378
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1379
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1380
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1381
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1382
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1383
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1384
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1385
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1386
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1387
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1388
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1389
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1390
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1391
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1392
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1393
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1394
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1395
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1396
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1397
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1398
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1399
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1400
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1401
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1402
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1403
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1404
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1405
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1406
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1407
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1408
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1409
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1410
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1411
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1412
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1413
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1414
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1415
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1416
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1417
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1418
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1419
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1420
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1421
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1422
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1423
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1424
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1425
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1426
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1427
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1428
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1429
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1430
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1431
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1432
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1433
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1434
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1435
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1436
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1437
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1438
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1439
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1440
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1441
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1442
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1443
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1444
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1445
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1446
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1447
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1448
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1449
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1450
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1451
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1452
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1453
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1454
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1455
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1456
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1457
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1458
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1459
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1460
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1461
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1462
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1463
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1464
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1465
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1466
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1467
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1468
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1469
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1470
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1471
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1472
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1473
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1474
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1475
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1476
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1477
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1478
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1479
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1480
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1481
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1482
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1483
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1484
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1485
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1486
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1487
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1488
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1489
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1490
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1491
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1492
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1493
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1494
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1495
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1496
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1497
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1498
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1499
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1500
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1501
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1502
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1503
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1504
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1505
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1506
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1507
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1508
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1509
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1510
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1511
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1512
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1513
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1514
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1515
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1516
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1517
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1518
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1519
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1520
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1521
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1522
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1523
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1524
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1525
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1526
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1527
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1528
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1529
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1530
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1531
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1532
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1533
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1534
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1535
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1536
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1537
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1538
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1539
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1540
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1541
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1542
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1543
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1544
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1545
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1546
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1547
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1548
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1549
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1550
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1551
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1552
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1553
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1554
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1555
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1556
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1557
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced047000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 1558
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1559
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1560
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1561
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1562
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1563
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1564
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1565
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1566
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1567
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1568
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1569
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1570
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1571
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1572
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1573
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1574
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1575
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1576
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 1577
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1578
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1579
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1580
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1581
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1582
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1583
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1584
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1585
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1586
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1587
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1588
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1589
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1590
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1591
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1592
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1593
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1594
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 1595
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1596
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 1597
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1598
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 1599
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1600
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 1601
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1602
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 1603
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1604
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 1605
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 1606
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 1607
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1608
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 0,
            "id": 1609
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 1,
            "id": 1610
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000378"
              }
            ],
            "repeated": 1,
            "id": 1611
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000037c"
              }
            ],
            "repeated": 0,
            "id": 1612
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1613
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              }
            ],
            "repeated": 0,
            "id": 1614
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              }
            ],
            "repeated": 0,
            "id": 1615
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1616
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              }
            ],
            "repeated": 0,
            "id": 1617
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1618
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 1619
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1620
          },
          {
            "timestamp": "2026-05-28 22:32:54,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1621
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\wups"
              },
              {
                "name": "DllBase",
                "value": "0x7fff93940000"
              }
            ],
            "repeated": 0,
            "id": 1622
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\wups.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff93940000"
              }
            ],
            "repeated": 0,
            "id": 1623
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1624
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1625
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1626
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1627
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1628
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1629
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x0000038c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 1630
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000390"
              }
            ],
            "repeated": 0,
            "id": 1631
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1632
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "(b\\x06\\xed\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1633
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd0j\\x06\\xed\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00e\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1634
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1635
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xe8l\\x07\\xed\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1636
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1637
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "Xn\\x04\\xed\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1638
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\x08\\xce#\\x98\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00p\\xabO\\xa4?\\x00\\x00\\x00h\\xabO\\xa4?\\x00\\x00\\x008\\xabO\\xa4?\\x00\\x00\\x00X\\xabO\\xa4"
              }
            ],
            "repeated": 0,
            "id": 1639
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00Pn\\x04\\xed\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00X\\xa9O\\xa4?\\x00\\x00\\x00\\x90\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1640
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1641
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "(k\\x06\\xed\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00e\\x00f\\x00b\\x00-\\x004\\x003\\x000\\x00a\\x00-\\x00a\\x006\\x00c\\x008\\x00-\\x00f\\x007\\x007\\x009\\x009\\x003\\x001\\x000\\x003\\x007\\x000\\x009\\x00:\\x001\\x00"
              }
            ],
            "repeated": 0,
            "id": 1642
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xb0l\\x06\\xed\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1643
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1644
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\x08m\\x07\\xed\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1645
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1646
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\xd8p\\x04\\xed\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1647
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xa8\\xf3#\\x98\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xd0\\xa7O\\xa4?\\x00\\x00\\x00\\xc8\\xa7O\\xa4?\\x00\\x00\\x00\\x98\\xa7O\\xa4?\\x00\\x00\\x00\\xb8\\xa7O\\xa4"
              }
            ],
            "repeated": 0,
            "id": 1648
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd0p\\x04\\xed\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xb8\\xa5O\\xa4?\\x00\\x00\\x00\\x90\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 1649
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 0,
            "id": 1650
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 0,
            "id": 1651
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 1652
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 1653
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 1654
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 1655
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x02\\x00\\x00\\x00\\x01\\x0f\\x86\\x00\\x00\\x00\\x00#\\x0f\\x86\\x02\\xb0\\x0c\\xcf\\x05|\\x05\\xf6\\x0e\\xeb\\x02:\\x0eh\\x0f\\x86\t\\x12\\x08\\x8f\\x01R\\x08\\x11\\x04\\x12\\x07\\x86\\x07\\x03\\x00\\xe0\\x06\\x85\\x03\\x9c\\x0c@\\x0b\\xb9\\x01\\xc4\\x0b6\\x05\\x02\n\\xa7\n \\x03&\t\\x9d\\x04\\x88\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00p\\x05M]Q\\x01L\\x00e\\x00g\\x00a\\x00c\\x00y\\x00U\\x00O\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x00i\\x00a\\x001\\x003\\x004\\x002\\x004\\x004\\x008\\x007\\x003\\x001\\x006\\x005\\x007\\x000\\x007\\x009\\x008\\x000\\x00C\\x00o\\x00r\\x00r\\x00e\\x00l\\x00a\\x00t\\x00i\\x00o\\x00n\\x00V\\x00e\\x00c\\x00t\\x00o\\x00r\\x001q\\x065\\x81%!\\x01W\\x00u\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x009\\x00c\\x00d"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 1656
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1657
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1658
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1659
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1660
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1661
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 1662
          },
          {
            "timestamp": "2026-05-28 22:32:54,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1663
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 3,
            "id": 1664
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 0,
            "id": 1665
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 1,
            "id": 1666
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 1,
            "id": 1667
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 1,
            "id": 1668
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 1,
            "id": 1669
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 1,
            "id": 1670
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 1,
            "id": 1671
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 1,
            "id": 1672
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 1,
            "id": 1673
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 1,
            "id": 1674
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 1,
            "id": 1675
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000038c"
              }
            ],
            "repeated": 1,
            "id": 1676
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000390"
              }
            ],
            "repeated": 0,
            "id": 1677
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 1678
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1679
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 1680
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 1681
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 1682
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 1683
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1684
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1685
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1686
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1687
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1688
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1689
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 1690
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 1691
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1692
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1693
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1694
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1695
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1696
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1697
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1698
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1699
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1700
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1701
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1702
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1703
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1704
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1705
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1706
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1707
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1708
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1709
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1710
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1711
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1712
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1713
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1714
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1715
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1716
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1717
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1718
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1719
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1720
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1721
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1722
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1723
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1724
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1725
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1726
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1727
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1728
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1729
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1730
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1731
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1732
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1733
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1734
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1735
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1736
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1737
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1738
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1739
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1740
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1741
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1742
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1743
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1744
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1745
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1746
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1747
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1748
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1749
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1750
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1751
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1752
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1753
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1754
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1755
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1756
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1757
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1758
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1759
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1760
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1761
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1762
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1763
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1764
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1765
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1766
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1767
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1768
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1769
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1770
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1771
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1772
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1773
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1774
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1775
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1776
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1777
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1778
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1779
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1780
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1781
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1782
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1783
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1784
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1785
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1786
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1787
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1788
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1789
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1790
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1791
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1792
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1793
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1794
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1795
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1796
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1797
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1798
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1799
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1800
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1801
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1802
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1803
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1804
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1805
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1806
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1807
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1808
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1809
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1810
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1811
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1812
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1813
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1814
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1815
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1816
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1817
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1818
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1819
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1820
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1821
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1822
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1823
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1824
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1825
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1826
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1827
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1828
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1829
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1830
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1831
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1832
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1833
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1834
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1835
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1836
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1837
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1838
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1839
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1840
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1841
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1842
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1843
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1844
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1845
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1846
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1847
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1848
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1849
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1850
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1851
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1852
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1853
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1854
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1855
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1856
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1857
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1858
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1859
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1860
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1861
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1862
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1863
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1864
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1865
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1866
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1867
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1868
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1869
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1870
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1871
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1872
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1873
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1874
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1875
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1876
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1877
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1878
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1879
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1880
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1881
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1882
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1883
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1884
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1885
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1886
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1887
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1888
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1889
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1890
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1891
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1892
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1893
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1894
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1895
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1896
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1897
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1898
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1899
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1900
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1901
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1902
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1903
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1904
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1905
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1906
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1907
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1908
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1909
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1910
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1911
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1912
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1913
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1914
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1915
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1916
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1917
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1918
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1919
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1920
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1921
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1922
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1923
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1924
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1925
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1926
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1927
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1928
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1929
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1930
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1931
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1932
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1933
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1934
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1935
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1936
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1937
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1938
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1939
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1940
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1941
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1942
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1943
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1944
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1945
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1946
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1947
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1948
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1949
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1950
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1951
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1952
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1953
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1954
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1955
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1956
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1957
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1958
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1959
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1960
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1961
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1962
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1963
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1964
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1965
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1966
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1967
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1968
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1969
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1970
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1971
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1972
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1973
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1974
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1975
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1976
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1977
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1978
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1979
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1980
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1981
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1982
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1983
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1984
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1985
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1986
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1987
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1988
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1989
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1990
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1991
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1992
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1993
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1994
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1995
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 1996
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 1997
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 1998
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 1999
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2000
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2001
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2002
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2003
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2004
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2005
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2006
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2007
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2008
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2009
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2010
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2011
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2012
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2013
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2014
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2015
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2016
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2017
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2018
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2019
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2020
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2021
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2022
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2023
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2024
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2025
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2026
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2027
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2028
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2029
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2030
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2031
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2032
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2033
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2034
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2035
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2036
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2037
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2038
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2039
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2040
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2041
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2042
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2043
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2044
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2045
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2046
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2047
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2048
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2049
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2050
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2051
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2052
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2053
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2054
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2055
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2056
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2057
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2058
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2059
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2060
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2061
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2062
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2063
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2064
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2065
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2066
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2067
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2068
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2069
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2070
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2071
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2072
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2073
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2074
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2075
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2076
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2077
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2078
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2079
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2080
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2081
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2082
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2083
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2084
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2085
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2086
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2087
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2088
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2089
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2090
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2091
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2092
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2093
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2094
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2095
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2096
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2097
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2098
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2099
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2100
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2101
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2102
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2103
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2104
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2105
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2106
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2107
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2108
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2109
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2110
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2111
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2112
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2113
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2114
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2115
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2116
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2117
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2118
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2119
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2120
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2121
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2122
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2123
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2124
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2125
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2126
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2127
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2128
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2129
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2130
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2131
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2132
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2133
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2134
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2135
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2136
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2137
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2138
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2139
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2140
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2141
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2142
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2143
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2144
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2145
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2146
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2147
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2148
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 0,
            "id": 2149
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2150
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2151
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2152
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2153
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2154
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2155
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2156
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2157
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2158
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2159
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2160
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2161
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2162
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2163
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2164
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2165
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 2166
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 2167
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 2168
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 2169
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 2170
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 2171
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 2172
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 2173
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 2174
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 2175
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 2176
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 1,
            "id": 2177
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000398"
              }
            ],
            "repeated": 1,
            "id": 2178
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000039c"
              }
            ],
            "repeated": 0,
            "id": 2179
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 2180
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 0,
            "id": 2181
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 2182
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 1,
            "id": 2183
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 2184
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 2185
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 2186
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a4"
              }
            ],
            "repeated": 1,
            "id": 2187
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 2188
          },
          {
            "timestamp": "2026-05-28 22:32:54,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "IsDebuggerPresent",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Status",
                "value": "Log limit reached"
              }
            ],
            "repeated": 0,
            "id": 2189
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2190
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 2191
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2192
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2193
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2194
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2195
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2196
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2197
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12628",
            "caller": "0x7fff965054eb",
            "parentcaller": "0x7fff97018ce0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc3\\xcc\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00ke\\x03\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2198
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12628",
            "caller": "0x7fff96506785",
            "parentcaller": "0x7fff97018c8a",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2199
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2200
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 2201
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 2202
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 2203
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 2204
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e798",
            "parentcaller": "0x7ff6d4887b1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings"
              },
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings"
              }
            ],
            "repeated": 0,
            "id": 2205
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e798",
            "parentcaller": "0x7ff6d4887b1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "ValueName",
                "value": "RootDirectory"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings\\RootDirectory"
              }
            ],
            "repeated": 0,
            "id": 2206
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e798",
            "parentcaller": "0x7ff6d4887b1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "ValueName",
                "value": "RootDirectory"
              },
              {
                "name": "Data",
                "value": "%WINDIR%"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings\\RootDirectory"
              }
            ],
            "repeated": 0,
            "id": 2207
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e798",
            "parentcaller": "0x7ff6d4887b1c",
            "category": "filesystem",
            "api": "CreateDirectoryW",
            "status": false,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\SoftwareDistribution"
              }
            ],
            "repeated": 0,
            "id": 2208
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e798",
            "parentcaller": "0x7ff6d4887b1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 2209
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e798",
            "parentcaller": "0x7ff6d4887b1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Test"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Test"
              }
            ],
            "repeated": 0,
            "id": 2210
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e798",
            "parentcaller": "0x7ff6d4887b1c",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\SoftwareDistribution\\autest.cab"
              }
            ],
            "repeated": 0,
            "id": 2211
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 2212
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 2213
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 2214
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 2215
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2216
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2217
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000035c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 2218
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 2219
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 2220
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 2221
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 2222
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000035c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 2223
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 2224
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 2225
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 2226
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 2227
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 2228
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2229
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\\x15\\x0f\\xfb\\x0cB\n\\xea\nc\t\\x0b\\x08\\x84\\x074\\x06\\xb1\\x05a\\x04\\xde\\x0fK\\x04a\rl\\x0b\\x8d\\x03g\t\\xae\\x07\\xd3\\x02q\\x06\\x00\\x01\\xf8\\x01\\x7f\\x02\\xea\\x01\\x06\\x03\\xe4\\x00\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00w#\\x075\\x81-!\\x11\\x08W\\x00u\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x006\\x005\\x000\\x000\\x00a\\x00f\\x004\\x003\\x00-\\x005\\x003\\x003\\x00e\\x00-\\x004\\x001\\x00f\\x008\\x00-\\x008\\x004\\x001\\x003\\x00-\\x00f\\x007\\x000\\x006\\x004\\x008\\x007\\x007\\x007\\x00d\\x001\\x003\\x00:\\x002\\x000\\x001\\x00i\\x00s\\x00I\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 2230
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 2231
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 2232
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 2233
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2234
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\r\\x05a\\x00\\x0f\\x04\\xde\\x00\\x0e!\\x0cB\nc\\x08\\x84\\x06\\xb1\\x04\\xde\rl\\x0b\\x8d\\x07\\xcf\\x06\\x00\t\\xb2\\x07V\t5\\x0b\\x14\\x0c\\xef\\x0c\\xef\\x06\\x00\\x01\\x7f\\x02\\xea\\x01\\x06\\x03\\xe4\\x00\\x8d\\x00\\x8d\\x00\\x8d\\x00\\x8d\\x00\\x8d\\x00\\x8d\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x06\\x00\\x04Q\\x81-!\\x11\\x08W\\x00u\\x00P\\x00r\\x00o\\x00v\\x00i\\x00d\\x00e\\x00r\\x006\\x005\\x000\\x000\\x00a\\x00f\\x004\\x003\\x00-\\x005\\x003\\x003\\x00e\\x00-\\x004\\x001\\x00f\\x008\\x00-\\x008\\x004\\x001\\x003\\x00-\\x00f\\x007\\x000\\x006\\x004\\x008\\x007\\x007\\x007\\x00d\\x001\\x003\\x00:\\x002\\x000\\x001\\x00i\\x00s\\x00I\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 2235
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d48755c1",
            "parentcaller": "0x7ff6d47d0566",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B52AB030-8EF5-4621-B480-4D20975D1D26"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "84DB9AFD-0DDB-424D-A25D-5BC47C4451D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2236
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 2237
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 2238
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 2239
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 2240
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 2241
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 2242
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 2243
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 2244
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 2245
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 2246
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 2247
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 2248
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 2249
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 2250
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 2251
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2252
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2253
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 2254
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2255
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 2256
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2257
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2258
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2259
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2260
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2261
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2262
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 2263
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2264
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2265
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2266
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2267
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2268
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2269
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2270
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2271
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2272
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2273
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2274
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2275
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2276
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2277
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2278
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2279
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2280
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2281
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2282
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2283
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2284
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2285
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2286
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2287
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2288
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2289
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2290
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2291
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2292
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2293
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2294
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2295
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2296
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2297
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2298
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2299
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2300
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2301
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2302
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2303
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2304
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2305
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2306
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2307
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2308
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2309
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2310
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2311
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2312
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2313
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2314
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2315
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2316
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2317
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2318
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2319
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2320
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2321
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2322
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2323
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2324
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2325
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2326
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2327
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2328
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2329
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2330
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2331
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2332
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2333
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2334
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2335
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2336
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2337
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2338
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2339
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2340
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2341
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2342
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2343
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2344
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2345
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2346
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2347
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2348
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2349
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2350
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2351
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2352
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2353
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2354
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2355
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2356
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2357
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2358
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2359
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2360
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2361
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2362
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2363
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2364
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2365
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2366
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2367
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2368
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2369
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2370
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2371
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2372
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2373
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2374
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2375
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2376
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2377
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2378
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2379
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2380
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2381
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2382
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2383
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2384
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2385
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2386
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2387
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2388
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2389
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2390
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2391
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2392
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2393
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2394
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2395
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2396
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2397
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2398
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2399
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2400
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2401
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2402
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2403
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2404
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2405
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2406
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2407
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2408
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2409
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2410
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2411
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2412
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2413
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2414
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2415
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2416
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2417
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2418
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2419
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2420
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2421
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2422
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2423
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2424
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2425
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2426
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2427
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2428
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2429
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 2430
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2431
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2432
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2433
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2434
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2435
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2436
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2437
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2438
          },
          {
            "timestamp": "2026-05-28 22:32:54,293",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2439
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2440
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2441
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2442
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2443
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2444
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2445
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2446
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2447
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2448
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2449
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2450
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2451
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2452
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2453
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2454
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2455
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2456
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2457
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2458
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2459
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2460
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2461
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2462
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2463
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2464
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2465
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2466
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2467
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2468
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2469
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2470
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2471
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2472
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2473
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2474
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2475
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2476
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2477
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2478
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2479
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2480
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2481
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2482
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2483
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2484
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2485
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2486
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2487
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2488
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2489
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2490
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2491
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2492
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2493
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2494
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2495
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2496
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2497
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2498
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2499
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2500
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2501
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2502
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2503
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2504
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2505
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2506
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2507
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2508
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2509
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2510
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2511
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2512
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2513
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2514
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2515
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2516
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2517
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2518
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2519
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2520
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2521
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2522
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2523
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2524
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2525
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2526
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2527
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2528
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2529
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2530
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2531
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2532
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2533
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2534
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2535
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2536
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2537
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2538
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2539
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2540
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2541
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2542
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2543
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2544
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2545
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2546
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2547
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2548
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2549
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2550
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2551
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2552
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2553
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2554
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2555
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2556
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2557
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2558
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2559
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2560
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2561
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2562
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2563
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2564
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2565
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2566
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2567
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2568
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2569
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2570
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2571
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2572
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2573
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2574
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2575
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2576
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2577
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2578
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2579
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2580
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2581
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2582
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2583
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2584
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2585
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2586
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2587
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2588
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2589
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2590
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2591
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2592
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2593
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2594
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2595
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2596
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2597
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2598
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2599
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2600
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2601
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2602
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2603
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2604
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2605
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2606
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2607
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2608
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2609
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2610
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2611
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2612
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2613
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2614
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2615
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2616
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2617
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2618
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2619
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2620
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2621
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2622
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2623
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2624
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2625
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2626
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2627
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2628
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2629
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2630
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2631
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2632
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2633
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2634
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2635
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2636
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2637
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2638
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2639
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2640
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2641
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2642
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2643
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2644
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2645
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2646
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2647
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2648
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2649
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2650
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2651
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2652
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2653
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2654
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2655
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2656
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2657
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2658
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2659
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2660
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2661
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2662
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2663
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2664
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2665
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2666
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2667
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2668
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2669
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2670
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2671
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2672
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2673
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2674
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2675
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2676
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2677
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2678
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2679
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2680
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2681
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2682
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2683
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2684
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2685
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2686
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2687
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2688
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2689
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2690
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2691
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2692
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2693
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2694
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2695
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2696
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2697
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2698
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2699
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2700
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2701
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 2702
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2703
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2704
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2705
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2706
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2707
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2708
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2709
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2710
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2711
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2712
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2713
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2714
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2715
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2716
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2717
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2718
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2719
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2720
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2721
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 2722
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 2723
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2724
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2725
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2726
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2727
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2728
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2729
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2730
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2731
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2732
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2733
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2734
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2735
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2736
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2737
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 2738
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2739
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 1,
            "id": 2740
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2741
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 1,
            "id": 2742
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2743
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 1,
            "id": 2744
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2745
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 1,
            "id": 2746
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2747
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 1,
            "id": 2748
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2749
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 1,
            "id": 2750
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 2751
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 2752
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 0,
            "id": 2753
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 2754
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 2755
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 2756
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              }
            ],
            "repeated": 0,
            "id": 2757
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              }
            ],
            "repeated": 1,
            "id": 2758
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 2759
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2760
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2761
          },
          {
            "timestamp": "2026-05-28 22:32:54,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2762
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 2763
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 2764
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 2765
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 2766
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2767
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2768
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2769
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2770
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 2771
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2772
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 2773
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 2774
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 2775
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 2776
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 2777
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 2778
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 2779
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 2780
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 2781
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 2782
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 1,
            "id": 2783
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000036c"
              }
            ],
            "repeated": 1,
            "id": 2784
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003a8"
              }
            ],
            "repeated": 0,
            "id": 2785
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2786
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 2787
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 2788
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 2789
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 2790
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2791
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2792
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2793
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2794
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2795
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2796
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 2797
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 2798
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2799
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2800
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2801
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2802
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2803
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2804
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2805
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2806
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2807
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2808
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2809
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2810
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2811
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2812
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2813
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2814
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2815
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2816
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2817
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2818
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2819
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2820
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2821
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2822
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2823
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2824
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2825
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2826
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2827
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2828
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2829
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2830
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2831
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2832
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2833
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2834
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2835
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2836
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2837
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2838
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2839
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2840
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2841
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2842
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2843
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2844
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2845
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2846
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2847
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2848
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2849
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2850
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2851
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2852
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2853
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2854
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2855
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2856
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2857
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2858
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2859
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2860
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2861
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2862
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2863
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2864
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2865
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2866
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2867
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2868
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2869
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2870
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2871
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2872
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2873
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2874
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2875
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2876
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2877
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2878
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2879
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2880
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2881
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2882
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2883
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2884
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2885
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2886
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2887
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2888
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2889
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2890
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2891
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2892
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2893
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2894
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2895
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2896
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2897
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2898
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2899
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2900
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2901
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2902
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2903
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2904
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2905
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2906
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2907
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2908
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2909
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2910
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2911
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2912
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2913
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2914
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2915
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2916
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2917
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2918
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2919
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2920
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2921
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2922
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2923
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2924
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2925
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2926
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2927
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2928
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2929
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2930
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2931
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2932
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2933
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2934
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2935
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2936
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2937
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2938
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2939
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2940
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2941
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2942
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2943
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2944
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2945
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2946
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2947
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2948
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2949
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2950
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2951
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2952
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2953
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2954
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2955
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2956
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2957
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2958
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2959
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2960
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2961
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2962
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2963
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2964
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2965
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2966
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2967
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2968
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2969
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2970
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2971
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2972
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2973
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2974
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2975
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2976
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2977
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2978
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2979
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2980
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2981
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2982
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2983
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2984
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2985
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2986
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2987
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2988
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2989
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2990
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2991
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2992
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2993
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2994
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2995
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 2996
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 2997
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 2998
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 2999
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3000
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3001
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3002
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3003
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3004
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3005
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3006
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3007
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3008
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3009
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3010
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3011
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3012
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3013
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3014
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3015
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3016
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3017
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3018
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3019
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3020
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3021
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3022
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3023
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3024
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3025
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3026
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3027
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3028
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3029
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3030
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3031
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3032
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3033
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3034
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3035
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3036
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3037
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3038
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3039
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3040
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3041
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3042
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3043
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3044
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3045
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3046
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3047
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3048
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3049
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3050
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3051
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3052
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3053
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3054
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3055
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3056
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3057
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3058
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3059
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3060
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3061
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3062
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3063
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3064
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3065
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3066
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3067
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3068
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3069
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3070
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3071
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3072
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3073
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3074
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3075
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3076
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3077
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3078
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3079
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3080
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3081
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3082
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3083
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3084
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3085
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3086
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3087
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3088
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3089
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3090
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3091
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3092
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3093
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3094
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3095
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3096
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3097
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3098
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3099
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3100
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3101
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3102
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3103
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3104
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3105
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3106
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3107
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3108
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3109
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3110
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3111
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3112
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3113
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3114
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3115
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3116
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3117
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3118
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3119
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3120
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3121
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3122
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3123
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3124
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3125
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3126
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3127
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3128
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3129
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3130
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3131
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3132
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3133
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3134
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3135
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3136
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3137
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3138
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3139
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3140
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3141
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3142
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3143
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3144
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3145
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3146
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3147
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3148
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3149
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3150
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3151
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3152
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3153
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3154
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3155
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3156
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3157
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3158
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3159
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3160
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3161
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3162
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3163
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3164
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3165
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3166
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3167
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3168
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3169
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3170
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3171
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3172
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3173
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3174
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3175
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3176
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3177
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3178
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3179
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3180
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3181
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3182
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3183
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3184
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3185
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3186
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3187
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3188
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3189
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3190
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3191
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3192
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3193
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3194
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3195
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3196
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3197
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3198
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3199
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3200
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3201
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3202
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3203
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3204
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3205
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3206
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3207
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3208
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3209
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3210
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3211
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3212
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3213
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3214
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3215
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3216
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3217
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3218
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3219
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3220
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3221
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3222
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3223
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3224
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3225
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3226
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3227
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3228
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3229
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3230
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3231
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3232
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3233
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3234
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3235
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3236
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3237
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3238
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3239
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3240
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3241
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3242
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3243
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3244
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3245
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3246
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3247
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3248
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3249
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3250
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3251
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3252
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3253
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3254
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3255
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 0,
            "id": 3256
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3257
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3258
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3259
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3260
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3261
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3262
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3263
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3264
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3265
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3266
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3267
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3268
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3269
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3270
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3271
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3272
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 3273
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 3274
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 3275
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 3276
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 3277
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 3278
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 3279
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 3280
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 3281
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 3282
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 3283
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 1,
            "id": 3284
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b0"
              }
            ],
            "repeated": 1,
            "id": 3285
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003b4"
              }
            ],
            "repeated": 0,
            "id": 3286
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 3287
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 3288
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 3289
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 3290
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 3291
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 3292
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3293
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000388"
              }
            ],
            "repeated": 0,
            "id": 3294
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 3295
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3296
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 3297
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3298
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3299
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3300
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3301
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3302
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 3303
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 3304
          },
          {
            "timestamp": "2026-05-28 22:32:54,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 3305
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 3306
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000354"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 3307
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 3308
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 3309
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3310
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3311
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 3312
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 3313
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 3314
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 3315
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 3316
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 3317
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 3318
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 3319
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 3320
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 3321
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 3322
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3323
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 3324
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 3325
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 3326
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3327
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d48755c1",
            "parentcaller": "0x7ff6d47d0566",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B52AB030-8EF5-4621-B480-4D20975D1D26"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "84DB9AFD-0DDB-424D-A25D-5BC47C4451D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3328
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 3329
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 3330
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 3331
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 3332
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 3333
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 3334
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 3335
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 3336
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 3337
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 3338
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 3339
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 3340
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 3341
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 3342
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 3343
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3344
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3345
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3346
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3347
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3348
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3349
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3350
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3351
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3352
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3353
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3354
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3355
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3356
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3357
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3358
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3359
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3360
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3361
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3362
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3363
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3364
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3365
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3366
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3367
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3368
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3369
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3370
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3371
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3372
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3373
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3374
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3375
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3376
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3377
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3378
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3379
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3380
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3381
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3382
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3383
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3384
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3385
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3386
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3387
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3388
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3389
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3390
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3391
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3392
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3393
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3394
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3395
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3396
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3397
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3398
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3399
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3400
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3401
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3402
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3403
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3404
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3405
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3406
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3407
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3408
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3409
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3410
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3411
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3412
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3413
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3414
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3415
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3416
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3417
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3418
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3419
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3420
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3421
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3422
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3423
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3424
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3425
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3426
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3427
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3428
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3429
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3430
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3431
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3432
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3433
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3434
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3435
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3436
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3437
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3438
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3439
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3440
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3441
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3442
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3443
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3444
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3445
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3446
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3447
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3448
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3449
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3450
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3451
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3452
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3453
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3454
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3455
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3456
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3457
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3458
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3459
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3460
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3461
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3462
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3463
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3464
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3465
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3466
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3467
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3468
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3469
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3470
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3471
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3472
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3473
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3474
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3475
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3476
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3477
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3478
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3479
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3480
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3481
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3482
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3483
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3484
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3485
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3486
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3487
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3488
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3489
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3490
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3491
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3492
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3493
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3494
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3495
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3496
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3497
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3498
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3499
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3500
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3501
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3502
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3503
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3504
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3505
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3506
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3507
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3508
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3509
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3510
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3511
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3512
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3513
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3514
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3515
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3516
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3517
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3518
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3519
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3520
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3521
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3522
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3523
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3524
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3525
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3526
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3527
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3528
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3529
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3530
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3531
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3532
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3533
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3534
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3535
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3536
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3537
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3538
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3539
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3540
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3541
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3542
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3543
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3544
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3545
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3546
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3547
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3548
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3549
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3550
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3551
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3552
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3553
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3554
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3555
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3556
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3557
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3558
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3559
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3560
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3561
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3562
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3563
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3564
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3565
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3566
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3567
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3568
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3569
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3570
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3571
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3572
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3573
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3574
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3575
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3576
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3577
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3578
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3579
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3580
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3581
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3582
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3583
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3584
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3585
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3586
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3587
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3588
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3589
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3590
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3591
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3592
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3593
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3594
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3595
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3596
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3597
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3598
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3599
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3600
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3601
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3602
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3603
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3604
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3605
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3606
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3607
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3608
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3609
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3610
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3611
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3612
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3613
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3614
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3615
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3616
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3617
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3618
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3619
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3620
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3621
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3622
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3623
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3624
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3625
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3626
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3627
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3628
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3629
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3630
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3631
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3632
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3633
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3634
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3635
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3636
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3637
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3638
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3639
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3640
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3641
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3642
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3643
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3644
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3645
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3646
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3647
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3648
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3649
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3650
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3651
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3652
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3653
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3654
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3655
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3656
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3657
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3658
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3659
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3660
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3661
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3662
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3663
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3664
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3665
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3666
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3667
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3668
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3669
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3670
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3671
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3672
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3673
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3674
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3675
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3676
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3677
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3678
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3679
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3680
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3681
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3682
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3683
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3684
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3685
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3686
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3687
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3688
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3689
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3690
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3691
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3692
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3693
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3694
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3695
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3696
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3697
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3698
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3699
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3700
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3701
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3702
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3703
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3704
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3705
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3706
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3707
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3708
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3709
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3710
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3711
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3712
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3713
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3714
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3715
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3716
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3717
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3718
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3719
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3720
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3721
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3722
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3723
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3724
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3725
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3726
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3727
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3728
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3729
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3730
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3731
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3732
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3733
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3734
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3735
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3736
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3737
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3738
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3739
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3740
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3741
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3742
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3743
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3744
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3745
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3746
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3747
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3748
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3749
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3750
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3751
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3752
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3753
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3754
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3755
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3756
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3757
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3758
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3759
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3760
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3761
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3762
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3763
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3764
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3765
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3766
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3767
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3768
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3769
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3770
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3771
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3772
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3773
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3774
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3775
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3776
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3777
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3778
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3779
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3780
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3781
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3782
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3783
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3784
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3785
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3786
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3787
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3788
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3789
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3790
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3791
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3792
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3793
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3794
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3795
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3796
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3797
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3798
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3799
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3800
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3801
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3802
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3803
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3804
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3805
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3806
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3807
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3808
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3809
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3810
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3811
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3812
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3813
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 3814
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3815
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3816
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3817
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3818
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3819
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3820
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3821
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3822
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3823
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3824
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3825
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3826
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3827
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3828
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3829
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3830
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3831
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3832
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3833
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3834
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3835
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3836
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3837
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3838
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3839
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3840
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3841
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 3842
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 3843
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 3844
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 0,
            "id": 3845
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 1,
            "id": 3846
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 1,
            "id": 3847
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 0,
            "id": 3848
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              }
            ],
            "repeated": 0,
            "id": 3849
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              }
            ],
            "repeated": 1,
            "id": 3850
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 3851
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3852
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3853
          },
          {
            "timestamp": "2026-05-28 22:32:54,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3854
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 3855
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              }
            ],
            "repeated": 0,
            "id": 3856
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 3857
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 3858
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\n\\x00\\x00\\x00\\x0f\\x08z\\x00\\x0fu\\x0e\\xf2\\x0e\\x80\\x0e\\x02\r\\x8c\\x0c\\xfd\\x0cv\\x0c\\x00\\x0b}\\x0b\\x03\nt\t\\xed\tw\\x08\\xf4\\x08z\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 3859
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3860
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3861
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3862
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3863
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 3864
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3865
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 0,
            "id": 3866
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 1,
            "id": 3867
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 1,
            "id": 3868
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 1,
            "id": 3869
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 1,
            "id": 3870
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 1,
            "id": 3871
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 1,
            "id": 3872
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 1,
            "id": 3873
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 1,
            "id": 3874
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 1,
            "id": 3875
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 1,
            "id": 3876
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d0"
              }
            ],
            "repeated": 1,
            "id": 3877
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003d4"
              }
            ],
            "repeated": 0,
            "id": 3878
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3879
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 3880
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 3881
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 3882
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 3883
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3884
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3885
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3886
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3887
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3888
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3889
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 3890
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 3891
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3892
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3893
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3894
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3895
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3896
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3897
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3898
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3899
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3900
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3901
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3902
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3903
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3904
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3905
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3906
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3907
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3908
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3909
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3910
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3911
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3912
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3913
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3914
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3915
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3916
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3917
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3918
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3919
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3920
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3921
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3922
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3923
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3924
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3925
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3926
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3927
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3928
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3929
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3930
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3931
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3932
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3933
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3934
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3935
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3936
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3937
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3938
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3939
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3940
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3941
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3942
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3943
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3944
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3945
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3946
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3947
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3948
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3949
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3950
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3951
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3952
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3953
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3954
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3955
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3956
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3957
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3958
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3959
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3960
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3961
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3962
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3963
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3964
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3965
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3966
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3967
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3968
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3969
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3970
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3971
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3972
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3973
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3974
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3975
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3976
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3977
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3978
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3979
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3980
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3981
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3982
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3983
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3984
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3985
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3986
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3987
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3988
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 3989
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 3990
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3991
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3992
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3993
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3994
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3995
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3996
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3997
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 3998
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 3999
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4000
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4001
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4002
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4003
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4004
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4005
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4006
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4007
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4008
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4009
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4010
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4011
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4012
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4013
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4014
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4015
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4016
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4017
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4018
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4019
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4020
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4021
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4022
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4023
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4024
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4025
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4026
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4027
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4028
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4029
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4030
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4031
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4032
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4033
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4034
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4035
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4036
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4037
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4038
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4039
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4040
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4041
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4042
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4043
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4044
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4045
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4046
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4047
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4048
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4049
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4050
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4051
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4052
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4053
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4054
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4055
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4056
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4057
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4058
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4059
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4060
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4061
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4062
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4063
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4064
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4065
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4066
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4067
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4068
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4069
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4070
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4071
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4072
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4073
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4074
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4075
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4076
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4077
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4078
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4079
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4080
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4081
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4082
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4083
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4084
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4085
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4086
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4087
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4088
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4089
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4090
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4091
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4092
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4093
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4094
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4095
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4096
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4097
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4098
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4099
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4100
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4101
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4102
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4103
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4104
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4105
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4106
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4107
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4108
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4109
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4110
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4111
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4112
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4113
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4114
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4115
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4116
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4117
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4118
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4119
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4120
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4121
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4122
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4123
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4124
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4125
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4126
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4127
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4128
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4129
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4130
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4131
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4132
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4133
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4134
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4135
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4136
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4137
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4138
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4139
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4140
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4141
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4142
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4143
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4144
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4145
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4146
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4147
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4148
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4149
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4150
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4151
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4152
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4153
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4154
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4155
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4156
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4157
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4158
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4159
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4160
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4161
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4162
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4163
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4164
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4165
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4166
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4167
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4168
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4169
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4170
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4171
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4172
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4173
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4174
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4175
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4176
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4177
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4178
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4179
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4180
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4181
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4182
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4183
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4184
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4185
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4186
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4187
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4188
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4189
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4190
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4191
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4192
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4193
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4194
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4195
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4196
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4197
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4198
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4199
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4200
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4201
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4202
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4203
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4204
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4205
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4206
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4207
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4208
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4209
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4210
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4211
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4212
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4213
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4214
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4215
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4216
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4217
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4218
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4219
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4220
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4221
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4222
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4223
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4224
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4225
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4226
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4227
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4228
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4229
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4230
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4231
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4232
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4233
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4234
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4235
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4236
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4237
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4238
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4239
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4240
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4241
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4242
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4243
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4244
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4245
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4246
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4247
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4248
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4249
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4250
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4251
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4252
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4253
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4254
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4255
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4256
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4257
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4258
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4259
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4260
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4261
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4262
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4263
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4264
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4265
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4266
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4267
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4268
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4269
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4270
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4271
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4272
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4273
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4274
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4275
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4276
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4277
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4278
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4279
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4280
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4281
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4282
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4283
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4284
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4285
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4286
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4287
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4288
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4289
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4290
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4291
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4292
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4293
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4294
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4295
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4296
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4297
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4298
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4299
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4300
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4301
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4302
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4303
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4304
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4305
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4306
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4307
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4308
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4309
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4310
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4311
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4312
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4313
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4314
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4315
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4316
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4317
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4318
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4319
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4320
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4321
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4322
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4323
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4324
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4325
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4326
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4327
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4328
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4329
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4330
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4331
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4332
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4333
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4334
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4335
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4336
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4337
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4338
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4339
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4340
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4341
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4342
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4343
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4344
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4345
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4346
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4347
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4348
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 0,
            "id": 4349
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4350
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4351
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4352
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4353
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4354
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4355
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4356
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4357
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4358
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4359
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4360
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4361
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4362
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4363
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4364
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4365
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 4366
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 4367
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 4368
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 4369
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 4370
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 4371
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 4372
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 4373
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 4374
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 4375
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 4376
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 1,
            "id": 4377
          },
          {
            "timestamp": "2026-05-28 22:32:54,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003dc"
              }
            ],
            "repeated": 1,
            "id": 4378
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e0"
              }
            ],
            "repeated": 0,
            "id": 4379
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e8"
              }
            ],
            "repeated": 0,
            "id": 4380
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 4381
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e8"
              }
            ],
            "repeated": 1,
            "id": 4382
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 4383
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003e8"
              }
            ],
            "repeated": 1,
            "id": 4384
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 0,
            "id": 4385
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003cc"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4386
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 4387
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 4388
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003cc"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4389
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003cc"
              }
            ],
            "repeated": 0,
            "id": 4390
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4391
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4392
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4393
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4394
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 4395
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 4396
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 4397
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 4398
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4399
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 4400
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 4401
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 4402
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4403
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4404
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000358"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 4405
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 4406
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 4407
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 4408
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 4409
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000358"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 4410
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 4411
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 4412
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 4413
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd"
              },
              {
                "name": "Length",
                "value": "16"
              },
              {
                "name": "Status",
                "value": "Maximum logged reads reached for this file"
              }
            ],
            "repeated": 0,
            "id": 4414
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 4415
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4416
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 4417
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 4418
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4419
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d48755c1",
            "parentcaller": "0x7ff6d47d0566",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B52AB030-8EF5-4621-B480-4D20975D1D26"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "84DB9AFD-0DDB-424D-A25D-5BC47C4451D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4420
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 4421
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 4422
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 4423
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 4424
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 4425
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 4426
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 4427
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 4428
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 4429
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 4430
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 4431
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 4432
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 4433
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 4434
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 4435
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4436
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 4437
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 1,
            "id": 4438
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 4439
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 1,
            "id": 4440
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 4441
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 1,
            "id": 4442
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4443
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4444
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4445
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4446
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4447
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4448
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4449
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4450
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4451
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4452
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4453
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4454
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4455
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4456
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4457
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4458
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4459
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4460
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4461
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4462
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4463
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4464
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4465
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4466
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4467
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4468
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4469
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4470
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4471
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4472
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4473
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4474
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4475
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4476
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4477
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4478
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4479
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4480
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4481
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4482
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4483
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4484
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4485
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4486
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4487
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4488
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4489
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4490
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4491
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4492
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4493
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4494
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4495
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4496
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4497
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4498
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4499
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4500
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4501
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4502
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4503
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4504
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4505
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4506
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4507
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4508
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4509
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4510
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4511
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4512
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4513
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4514
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4515
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4516
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4517
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4518
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4519
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4520
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4521
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4522
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4523
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4524
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4525
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4526
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4527
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4528
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4529
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4530
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4531
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4532
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4533
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4534
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4535
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4536
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4537
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4538
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4539
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4540
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4541
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4542
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4543
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4544
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4545
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4546
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4547
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4548
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4549
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4550
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4551
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4552
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4553
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4554
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4555
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4556
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4557
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4558
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4559
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4560
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4561
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4562
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4563
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4564
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4565
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4566
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4567
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4568
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4569
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4570
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4571
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4572
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4573
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4574
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4575
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4576
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4577
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4578
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4579
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4580
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4581
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4582
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4583
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4584
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4585
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4586
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4587
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4588
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4589
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4590
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4591
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4592
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4593
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4594
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4595
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4596
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4597
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4598
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4599
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4600
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4601
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4602
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4603
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4604
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4605
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4606
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4607
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4608
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4609
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4610
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4611
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4612
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4613
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4614
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4615
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4616
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4617
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4618
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4619
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4620
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4621
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4622
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4623
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4624
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4625
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4626
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4627
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4628
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4629
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4630
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4631
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4632
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4633
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4634
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4635
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4636
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4637
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4638
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4639
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4640
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4641
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4642
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4643
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4644
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4645
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4646
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4647
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4648
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4649
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4650
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4651
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4652
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4653
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4654
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4655
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4656
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4657
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4658
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4659
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4660
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4661
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4662
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4663
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4664
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4665
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4666
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4667
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4668
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4669
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4670
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4671
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4672
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4673
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4674
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4675
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4676
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4677
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4678
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4679
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4680
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4681
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4682
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4683
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4684
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4685
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4686
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4687
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4688
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4689
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4690
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4691
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4692
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4693
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4694
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4695
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4696
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4697
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4698
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4699
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4700
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4701
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4702
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4703
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4704
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4705
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4706
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4707
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4708
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4709
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4710
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4711
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4712
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4713
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4714
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4715
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4716
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4717
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4718
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4719
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4720
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4721
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4722
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4723
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4724
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4725
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4726
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4727
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4728
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4729
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4730
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4731
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4732
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4733
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4734
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4735
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4736
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4737
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4738
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4739
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4740
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4741
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4742
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4743
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4744
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4745
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4746
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4747
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4748
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4749
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 4750
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 4751
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4752
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4753
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4754
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4755
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4756
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4757
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4758
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4759
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4760
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4761
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4762
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4763
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4764
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4765
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4766
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4767
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 4768
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4769
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4770
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4771
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4772
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4773
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4774
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4775
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4776
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4777
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4778
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4779
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4780
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4781
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4782
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4783
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4784
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4785
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4786
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 4787
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4788
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4789
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4790
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4791
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4792
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4793
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4794
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4795
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4796
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4797
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4798
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4799
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4800
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4801
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4802
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4803
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4804
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4805
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4806
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4807
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 4808
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4809
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4810
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4811
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4812
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4813
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4814
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4815
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4816
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4817
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4818
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4819
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4820
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4821
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4822
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4823
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4824
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4825
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4826
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 4827
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4828
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4829
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4830
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4831
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4832
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4833
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4834
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4835
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4836
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4837
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4838
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4839
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4840
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4841
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4842
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4843
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 0,
            "id": 4844
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4845
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4846
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4847
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4848
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4849
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4850
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4851
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4852
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4853
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4854
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4855
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4856
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4857
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4858
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4859
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4860
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4861
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4862
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4863
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 4864
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 4865
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4866
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4867
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4868
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4869
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4870
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4871
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4872
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4873
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4874
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4875
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4876
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4877
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4878
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4879
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4880
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4881
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4882
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4883
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 4884
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 4885
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4886
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4887
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4888
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4889
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4890
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4891
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4892
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4893
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4894
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4895
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4896
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4897
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4898
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4899
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4900
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4901
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4902
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4903
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 4904
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 4905
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4906
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4907
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4908
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4909
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4910
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4911
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4912
          },
          {
            "timestamp": "2026-05-28 22:32:54,372",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4913
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4914
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4915
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4916
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4917
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 4918
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 4919
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4920
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4921
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4922
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4923
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4924
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4925
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4926
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4927
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4928
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4929
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4930
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4931
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4932
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4933
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4934
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4935
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4936
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4937
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4938
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4939
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4940
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4941
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4942
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4943
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4944
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 4945
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 4946
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 1,
            "id": 4947
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 4948
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 1,
            "id": 4949
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 4950
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 1,
            "id": 4951
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 4952
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 1,
            "id": 4953
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 4954
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 1,
            "id": 4955
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 4956
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 1,
            "id": 4957
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 4958
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 4959
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4960
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 4961
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4962
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              }
            ],
            "repeated": 0,
            "id": 4963
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}"
              }
            ],
            "repeated": 1,
            "id": 4964
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 4965
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4966
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4967
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4968
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 4969
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 4970
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 4971
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4972
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4973
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4974
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4975
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 4976
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 4977
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced081000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 4978
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4979
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 4980
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 4981
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 4982
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 4983
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 4984
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 4985
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 4986
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 4987
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 4988
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 1,
            "id": 4989
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000374"
              }
            ],
            "repeated": 1,
            "id": 4990
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000370"
              }
            ],
            "repeated": 0,
            "id": 4991
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 4992
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 4993
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 4994
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 4995
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 4996
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 4997
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 4998
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 4999
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5000
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5001
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5002
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5003
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5004
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5005
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5006
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5007
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5008
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5009
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5010
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5011
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5012
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5013
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5014
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5015
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5016
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5017
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5018
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5019
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5020
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5021
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5022
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5023
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5024
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5025
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5026
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5027
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5028
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5029
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5030
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5031
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5032
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5033
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5034
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5035
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5036
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5037
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5038
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5039
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5040
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5041
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5042
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5043
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5044
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5045
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5046
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5047
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5048
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5049
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5050
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5051
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5052
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5053
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5054
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5055
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5056
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5057
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5058
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5059
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5060
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5061
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5062
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5063
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5064
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5065
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced085000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5066
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5067
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5068
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5069
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5070
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5071
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5072
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5073
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5074
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5075
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5076
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5077
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5078
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5079
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5080
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5081
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5082
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5083
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5084
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5085
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5086
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5087
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5088
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5089
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5090
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5091
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5092
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5093
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5094
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5095
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5096
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5097
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5098
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5099
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5100
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5101
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5102
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5103
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5104
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5105
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5106
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5107
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5108
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5109
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5110
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5111
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5112
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5113
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5114
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5115
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5116
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5117
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5118
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5119
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5120
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5121
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5122
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5123
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5124
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5125
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5126
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5127
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5128
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5129
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5130
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5131
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5132
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5133
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5134
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5135
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5136
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5137
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5138
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5139
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5140
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5141
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5142
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5143
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5144
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5145
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5146
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5147
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5148
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5149
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5150
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5151
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5152
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5153
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5154
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5155
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5156
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5157
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5158
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5159
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5160
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5161
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5162
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5163
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5164
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5165
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5166
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5167
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5168
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5169
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5170
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5171
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5172
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5173
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5174
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5175
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5176
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5177
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5178
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5179
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5180
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5181
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5182
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5183
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5184
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5185
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5186
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5187
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5188
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5189
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5190
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5191
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5192
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5193
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5194
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5195
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5196
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5197
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5198
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5199
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5200
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5201
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5202
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5203
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5204
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5205
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5206
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5207
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5208
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5209
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5210
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5211
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5212
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5213
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5214
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5215
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5216
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5217
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5218
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5219
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5220
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5221
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5222
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5223
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5224
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5225
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5226
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5227
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5228
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5229
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5230
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5231
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5232
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5233
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5234
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5235
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5236
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5237
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5238
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5239
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5240
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5241
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5242
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5243
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5244
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5245
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5246
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5247
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5248
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5249
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5250
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5251
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5252
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5253
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5254
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5255
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5256
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5257
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5258
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5259
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5260
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5261
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5262
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5263
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5264
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5265
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5266
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5267
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5268
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5269
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5270
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5271
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5272
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5273
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5274
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5275
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5276
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5277
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5278
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5279
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5280
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5281
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5282
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5283
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5284
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5285
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5286
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5287
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5288
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5289
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5290
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5291
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5292
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5293
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5294
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5295
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5296
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5297
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5298
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5299
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5300
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5301
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5302
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5303
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5304
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5305
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5306
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5307
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5308
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5309
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5310
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5311
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5312
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5313
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5314
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5315
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5316
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5317
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5318
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5319
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5320
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5321
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5322
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5323
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5324
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5325
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5326
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5327
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5328
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5329
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5330
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5331
          },
          {
            "timestamp": "2026-05-28 22:32:54,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5332
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5333
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5334
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5335
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5336
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5337
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5338
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5339
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5340
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5341
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5342
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5343
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5344
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5345
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5346
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5347
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5348
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5349
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5350
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5351
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5352
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5353
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5354
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5355
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5356
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5357
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5358
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5359
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5360
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5361
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5362
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5363
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5364
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5365
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5366
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5367
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5368
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5369
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5370
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5371
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5372
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5373
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5374
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5375
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5376
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5377
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5378
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5379
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5380
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5381
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5382
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5383
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5384
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5385
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5386
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5387
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5388
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5389
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5390
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5391
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5392
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5393
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5394
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5395
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5396
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5397
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5398
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5399
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5400
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5401
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5402
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5403
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5404
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5405
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5406
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5407
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5408
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5409
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5410
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5411
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5412
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5413
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5414
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5415
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5416
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5417
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5418
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5419
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5420
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5421
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5422
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5423
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5424
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5425
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5426
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5427
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5428
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5429
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5430
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5431
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5432
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5433
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5434
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5435
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5436
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5437
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5438
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5439
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5440
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5441
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5442
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5443
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5444
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5445
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5446
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5447
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5448
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5449
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5450
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5451
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5452
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5453
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5454
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5455
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5456
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5457
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5458
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5459
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5460
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5461
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5462
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5463
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5464
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5465
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5466
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5467
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5468
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5469
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5470
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5471
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5472
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5473
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5474
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5475
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5476
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5477
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5478
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5479
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5480
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5481
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5482
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5483
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5484
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5485
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5486
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5487
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5488
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5489
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5490
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5491
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5492
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5493
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5494
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5495
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5496
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5497
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5498
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5499
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5500
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5501
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 5502
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f0"
              }
            ],
            "repeated": 0,
            "id": 5503
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 5504
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 1,
            "id": 5505
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 5506
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 1,
            "id": 5507
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 5508
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 1,
            "id": 5509
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 5510
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 1,
            "id": 5511
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 5512
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 1,
            "id": 5513
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 1,
            "id": 5514
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f8"
              }
            ],
            "repeated": 1,
            "id": 5515
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003f4"
              }
            ],
            "repeated": 0,
            "id": 5516
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5517
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5518
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5519
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced08a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5520
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5521
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5522
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5523
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 5524
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 5525
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5526
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 5527
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5528
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5529
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5530
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5531
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 5532
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 5533
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5534
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 5535
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5536
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 5537
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 5538
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 5539
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5540
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5541
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 5542
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 5543
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 5544
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5545
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5546
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000003c4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 5547
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 5548
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 5549
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 5550
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 5551
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5552
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 5553
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 5554
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5555
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x00X\\x0e\\x00\\x00\\xa8\\x10\\x00\\x00\\x00\\x00\\x00\\x00K\\x85\\xf0\\xec\\xf1\\xee\\xdc\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00X\\x0e\\x00\\x00 \\x00\\x00\\x008\\x10=\\xeb\\x8c\\x01\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x00\\xfc\\x00\\x13\\xc0\\x01\\x00\\x00\\x00\\xdc\\x11\\x00\\x00`\\x1f\\x00\\x00q\\xe1\\xa1\\xec\\xf1\\xee\\xdc\\x01\\xccg\\xddY\\xe1|\\xf8R\\xcft\\xfe\\x8a%z+k\\x00\\x00\\x00\\x0b\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00D5\\xa6\\xe6p\\x00\\x00\\x00\rm\n\\x80\\xf1\\xee\\x05\\x007q\n\\x80\\xf1\\xee\\xdc\\x01P\\x00\\x0c\\x00\\x01\\x00B\\x00B\\x00Microsoft.Windows.Update.Orchestrator.Worker\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x0b\\x00\\x00\\x00B\\x00B\\x00\\x00MoUsoCoreWork"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 5556
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5557
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d48755c1",
            "parentcaller": "0x7ff6d47d0566",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B52AB030-8EF5-4621-B480-4D20975D1D26"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "84DB9AFD-0DDB-424D-A25D-5BC47C4451D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5558
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 5559
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 5560
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 5561
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 5562
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 5563
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 5564
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 5565
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 5566
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 5567
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 5568
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 5569
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 5570
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 5571
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 5572
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 5573
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 0,
            "id": 5574
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5575
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5576
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5577
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5578
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5579
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5580
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 5581
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              }
            ],
            "repeated": 0,
            "id": 5582
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{8B24B027-1DEE-BABB-9A95-3517DFB9C552}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{8B24B027-1DEE-BABB-9A95-3517DFB9C552}"
              }
            ],
            "repeated": 0,
            "id": 5583
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 5584
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5585
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5586
          },
          {
            "timestamp": "2026-05-28 22:32:54,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5587
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 5588
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 5589
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5590
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5591
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5592
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5593
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5594
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5595
          },
          {
            "timestamp": "2026-05-28 22:32:55,965",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5596
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 5597
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 5598
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 5599
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 5600
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 5601
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 5602
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 5603
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 5604
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 5605
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 5606
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 1,
            "id": 5607
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003ec"
              }
            ],
            "repeated": 1,
            "id": 5608
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c8"
              }
            ],
            "repeated": 0,
            "id": 5609
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 5610
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5611
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5612
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5613
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5614
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5615
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5616
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5617
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5618
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5619
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5620
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5621
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 5622
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5623
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5624
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 5625
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5626
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 0,
            "id": 5627
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 5628
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 5629
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 5630
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5631
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 5632
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 5633
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 5634
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5635
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5636
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000358"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 5637
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 5638
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 5639
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 5640
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 5641
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000358"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 5642
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 5643
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 5644
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 5645
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 5646
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5647
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 5648
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 5649
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 5650
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d48755c1",
            "parentcaller": "0x7ff6d47d0566",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "B52AB030-8EF5-4621-B480-4D20975D1D26"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "84DB9AFD-0DDB-424D-A25D-5BC47C4451D4"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 5651
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d48755e5",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d5000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5652
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d48755e5",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5653
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d48755e5",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedbe4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5654
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 5655
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5656
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5657
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5658
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5659
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5660
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5661
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5662
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5663
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5664
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5665
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5666
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 1,
            "id": 5667
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000248"
              }
            ],
            "repeated": 1,
            "id": 5668
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 5669
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedbf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003de000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5670
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedbf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5671
          },
          {
            "timestamp": "2026-05-28 22:32:55,981",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfcd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 5672
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5673
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5674
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5675
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5676
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5677
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5678
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5679
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5680
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5681
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5682
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5683
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5684
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5685
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5686
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5687
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5688
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5689
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5690
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5691
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced08c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5692
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5693
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5694
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5695
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5696
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5697
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5698
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5699
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5700
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5701
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5702
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5703
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5704
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5705
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5706
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5707
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5708
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5709
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced091000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5710
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5711
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5712
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5713
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5714
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5715
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5716
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5717
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceace3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5718
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5719
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5720
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5721
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5722
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5723
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5724
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5725
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5726
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5727
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5728
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5729
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5730
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5731
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5732
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5733
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5734
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5735
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5736
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5737
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5738
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5739
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced094000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5740
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5741
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5742
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5743
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5744
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5745
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5746
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5747
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5748
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5749
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5750
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5751
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5752
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5753
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5754
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5755
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5756
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5757
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced097000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5758
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5759
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5760
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5761
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5762
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5763
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5764
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5765
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5766
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5767
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5768
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5769
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5770
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5771
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5772
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5773
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5774
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5775
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5776
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5777
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5778
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5779
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5780
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced09a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5781
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5782
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5783
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5784
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5785
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5786
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5787
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5788
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5789
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5790
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced09c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5791
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5792
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5793
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5794
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5795
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5796
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5797
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5798
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5799
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5800
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5801
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5802
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5803
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5804
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5805
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5806
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5807
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5808
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5809
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5810
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5811
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5812
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5813
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5814
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5815
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5816
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5817
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5818
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5819
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced09f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5820
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5821
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5822
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5823
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5824
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5825
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5826
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5827
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5828
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5829
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5830
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5831
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5832
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5833
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5834
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5835
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5836
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5837
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5838
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5839
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5840
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5841
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5842
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5843
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5844
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5845
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0a3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5846
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5847
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5848
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5849
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5850
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5851
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5852
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5853
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5854
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5855
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5856
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5857
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5858
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5859
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5860
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5861
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5862
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5863
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5864
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5865
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5866
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5867
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5868
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0a6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5869
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5870
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5871
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5872
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5873
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5874
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5875
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5876
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5877
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5878
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5879
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5880
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5881
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5882
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5883
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5884
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5885
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5886
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5887
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5888
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5889
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5890
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5891
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5892
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0a9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5893
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5894
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5895
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5896
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5897
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5898
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5899
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5900
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5901
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5902
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5903
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5904
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5905
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5906
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5907
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5908
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5909
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5910
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5911
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5912
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5913
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5914
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5915
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5916
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5917
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5918
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5919
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5920
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0b1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5921
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 5922
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5923
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5924
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5925
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5926
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5927
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5928
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5929
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5930
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5931
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5932
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5933
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5934
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5935
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5936
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5937
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5938
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5939
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5940
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5941
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5942
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5943
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5944
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5945
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5946
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5947
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5948
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5949
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5950
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5951
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5952
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5953
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0b6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5954
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5955
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5956
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5957
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5958
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5959
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5960
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5961
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5962
          },
          {
            "timestamp": "2026-05-28 22:32:55,997",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5963
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5964
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5965
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5966
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5967
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5968
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5969
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5970
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5971
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5972
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5973
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5974
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5975
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5976
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5977
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0b9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5978
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5979
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5980
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5981
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5982
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5983
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5984
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5985
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5986
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5987
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5988
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5989
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5990
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5991
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0be000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 5992
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 5993
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5994
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5995
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5996
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5997
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 5998
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 5999
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6000
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6001
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6002
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6003
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6004
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6005
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6006
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6007
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6008
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6009
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6010
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6011
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6012
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6013
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6014
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6015
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6016
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6017
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6018
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 6019
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6020
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 6021
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6022
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6023
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6024
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6025
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6026
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6027
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6028
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6029
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6030
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6031
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6032
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0c4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6033
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6034
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6035
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6036
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6037
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6038
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6039
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6040
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6041
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6042
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6043
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6044
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6045
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6046
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6047
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6048
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6049
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6050
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6051
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6052
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6053
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6054
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6055
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6056
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6057
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6058
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6059
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6060
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6061
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6062
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6063
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6064
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6065
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6066
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6067
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6068
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6069
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6070
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6071
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6072
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6073
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6074
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6075
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6076
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6077
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6078
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6079
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6080
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0c9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6081
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6082
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6083
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6084
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6085
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6086
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6087
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6088
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6089
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6090
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6091
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6092
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6093
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6094
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6095
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6096
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6097
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6098
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6099
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6100
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6101
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6102
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6103
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6104
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6105
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6106
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6107
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6108
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6109
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6110
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6111
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6112
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6113
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6114
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6115
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6116
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6117
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6118
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6119
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6120
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6121
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6122
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6123
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6124
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6125
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6126
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6127
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6128
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6129
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6130
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6131
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6132
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6133
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6134
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6135
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6136
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6137
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6138
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 6139
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6140
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 6141
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6142
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6143
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6144
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6145
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6146
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6147
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6148
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6149
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6150
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6151
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6152
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6153
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6154
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6155
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6156
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6157
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6158
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6159
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6160
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6161
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6162
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6163
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6164
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6165
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6166
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6167
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6168
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6169
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6170
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6171
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6172
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6173
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6174
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6175
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6176
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6177
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6178
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6179
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6180
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6181
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6182
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6183
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6184
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6185
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6186
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6187
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6188
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6189
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6190
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6191
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6192
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6193
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6194
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6195
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6196
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6197
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6198
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6199
          },
          {
            "timestamp": "2026-05-28 22:32:56,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6200
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6201
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6202
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6203
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6204
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6205
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6206
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6207
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6208
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6209
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6210
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6211
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6212
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6213
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6214
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6215
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6216
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6217
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6218
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6219
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6220
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6221
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6222
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6223
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6224
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6225
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6226
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0df000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6227
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6228
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6229
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6230
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6231
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6232
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6233
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6234
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6235
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6236
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6237
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6238
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6239
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6240
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6241
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6242
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6243
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6244
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6245
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6246
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6247
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6248
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6249
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6250
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6251
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6252
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6253
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6254
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6255
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6256
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6257
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6258
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 6259
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6260
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 0,
            "id": 6261
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6262
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6263
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6264
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6265
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6266
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6267
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6268
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6269
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6270
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6271
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6272
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6273
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6274
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6275
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6276
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6277
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6278
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6279
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6280
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6281
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 6282
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6283
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 6284
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6285
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 6286
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6287
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 6288
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6289
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 1,
            "id": 6290
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c0"
              }
            ],
            "repeated": 1,
            "id": 6291
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000035c"
              }
            ],
            "repeated": 0,
            "id": 6292
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6293
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 6294
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6295
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 6296
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6297
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 6298
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6299
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6300
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6301
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6302
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6303
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6304
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6305
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6306
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6307
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6308
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6309
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6310
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6311
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6312
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6313
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6314
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6315
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6316
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6317
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6318
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6319
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00400000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6320
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6321
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6322
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6323
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6324
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6325
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6326
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6327
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6328
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6329
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6330
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6331
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6332
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6333
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6334
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6335
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6336
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6337
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6338
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6339
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6340
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6341
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6342
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6343
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6344
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6345
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6346
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6347
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6348
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6349
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6350
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6351
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6352
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6353
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6354
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfda000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6355
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6356
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6357
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6358
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6359
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6360
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6361
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6362
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6363
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6364
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6365
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6366
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6367
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6368
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6369
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6370
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6371
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6372
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6373
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6374
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6375
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6376
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6377
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6378
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6379
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6380
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6381
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6382
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6383
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6384
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6385
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6386
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6387
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6388
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6389
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6390
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6391
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6392
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6393
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfdf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6394
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6395
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6396
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6397
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6398
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6399
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6400
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6401
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6402
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6403
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6404
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6405
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfe4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6406
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6407
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6408
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6409
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6410
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6411
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6412
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6413
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6414
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6415
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6416
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6417
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6418
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6419
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6420
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6421
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6422
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6423
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfe9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6424
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6425
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6426
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6427
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6428
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6429
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6430
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6431
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6432
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6433
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6434
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6435
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6436
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6437
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6438
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6439
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6440
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6441
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6442
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6443
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6444
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6445
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6446
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6447
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6448
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6449
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6450
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6451
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6452
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6453
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6454
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6455
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6456
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6457
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6458
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6459
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6460
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6461
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6462
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6463
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6464
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6465
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6466
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6467
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6468
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6469
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6470
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6471
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6472
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6473
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6474
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6475
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6476
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6477
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6478
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6479
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6480
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6481
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6482
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6483
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6484
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6485
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6486
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6487
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6488
          },
          {
            "timestamp": "2026-05-28 22:32:56,028",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6489
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6490
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6491
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6492
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6493
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6494
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6495
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6496
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6497
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6498
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6499
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6500
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6501
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6502
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6503
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6504
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6505
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6506
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6507
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6508
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6509
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6510
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6511
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6512
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6513
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6514
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6515
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6516
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedff2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6517
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6518
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6519
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6520
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6521
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6522
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6523
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6524
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6525
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6526
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6527
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6528
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6529
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6530
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6531
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6532
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6533
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6534
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6535
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6536
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6537
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6538
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6539
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6540
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6541
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6542
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6543
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6544
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6545
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6546
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6547
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6548
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6549
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6550
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6551
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6552
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6553
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6554
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6555
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6556
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6557
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6558
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6559
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6560
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6561
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6562
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6563
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6564
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6565
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6566
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6567
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedffb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6568
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6569
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6570
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6571
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6572
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6573
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6574
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6575
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6576
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6577
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6578
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6579
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6580
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6581
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6582
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6583
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6584
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee004000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6585
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6586
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6587
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6588
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6589
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6590
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6591
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6592
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6593
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6594
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6595
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6596
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6597
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6598
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6599
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6600
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6601
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6602
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6603
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6604
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6605
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6606
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6607
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6608
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6609
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6610
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6611
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6612
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6613
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6614
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6615
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee009000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6616
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6617
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6618
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6619
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6620
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6621
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6622
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6623
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6624
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6625
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6626
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6627
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6628
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6629
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6630
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6631
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6632
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6633
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6634
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6635
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6636
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6637
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6638
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6639
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6640
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6641
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6642
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6643
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6644
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6645
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6646
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6647
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6648
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6649
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6650
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6651
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6652
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6653
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6654
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6655
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6656
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6657
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6658
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6659
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6660
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6661
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6662
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6663
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6664
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6665
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6666
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6667
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6668
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6669
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6670
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6671
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6672
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6673
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6674
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6675
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6676
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6677
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6678
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6679
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6680
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6681
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6682
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6683
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6684
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6685
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6686
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6687
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6688
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6689
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6690
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6691
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6692
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6693
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6694
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6695
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6696
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6697
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6698
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6699
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6700
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6701
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6702
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6703
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6704
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6705
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6706
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6707
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6708
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6709
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6710
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6711
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6712
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6713
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6714
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6715
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6716
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6717
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee01a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6718
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6719
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6720
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6721
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6722
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6723
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6724
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6725
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6726
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6727
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6728
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6729
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6730
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6731
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6732
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6733
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6734
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6735
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6736
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6737
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6738
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6739
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6740
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6741
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6742
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6743
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6744
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6745
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6746
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6747
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6748
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6749
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6750
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6751
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6752
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6753
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6754
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6755
          },
          {
            "timestamp": "2026-05-28 22:32:56,043",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6756
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6757
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6758
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6759
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6760
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6761
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6762
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6763
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6764
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6765
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6766
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6767
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6768
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6769
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6770
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6771
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6772
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6773
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee01f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6774
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6775
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6776
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6777
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6778
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6779
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6780
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6781
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6782
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6783
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6784
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6785
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6786
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6787
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6788
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6789
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6790
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6791
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6792
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6793
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6794
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6795
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6796
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6797
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6798
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6799
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6800
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6801
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6802
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6803
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6804
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6805
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6806
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6807
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6808
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6809
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6810
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6811
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6812
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6813
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6814
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6815
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6816
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee024000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6817
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6818
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6819
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6820
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6821
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6822
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6823
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6824
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6825
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6826
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6827
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6828
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6829
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6830
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6831
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6832
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6833
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6834
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6835
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6836
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6837
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6838
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6839
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6840
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6841
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6842
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6843
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6844
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6845
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6846
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6847
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6848
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6849
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6850
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6851
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6852
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee035000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6853
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6854
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6855
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6856
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6857
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6858
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6859
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6860
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6861
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6862
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6863
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6864
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6865
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6866
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6867
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6868
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6869
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6870
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6871
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6872
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6873
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6874
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6875
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6876
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6877
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6878
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6879
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6880
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6881
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6882
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6883
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6884
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6885
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6886
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6887
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6888
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6889
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6890
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6891
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6892
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6893
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6894
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6895
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6896
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6897
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6898
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6899
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6900
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6901
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6902
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6903
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6904
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6905
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6906
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6907
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6908
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6909
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6910
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6911
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6912
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6913
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6914
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6915
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6916
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6917
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6918
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6919
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6920
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6921
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6922
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee03a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6923
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 6924
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6925
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6926
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6927
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6928
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6929
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6930
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6931
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6932
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6933
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6934
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6935
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6936
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6937
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6938
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6939
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6940
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6941
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6942
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6943
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6944
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6945
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6946
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6947
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6948
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6949
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6950
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6951
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6952
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6953
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6954
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6955
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6956
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6957
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6958
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6959
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6960
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6961
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6962
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6963
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6964
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6965
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee03f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6966
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6967
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6968
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6969
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6970
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6971
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6972
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6973
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6974
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6975
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6976
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6977
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6978
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6979
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6980
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6981
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6982
          },
          {
            "timestamp": "2026-05-28 22:32:56,059",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6983
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6984
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6985
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6986
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6987
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6988
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6989
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6990
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6991
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6992
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6993
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee048000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 6994
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 6995
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6996
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6997
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 6998
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 6999
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7000
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7001
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7002
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7003
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7004
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7005
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7006
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7007
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7008
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7009
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7010
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7011
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7012
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7013
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7014
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7015
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7016
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7017
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7018
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7019
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7020
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7021
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7022
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7023
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7024
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 7025
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee051000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7026
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 7027
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7028
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7029
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7030
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7031
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7032
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7033
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7034
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7035
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7036
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7037
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7038
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7039
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7040
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7041
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7042
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7043
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7044
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7045
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7046
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7047
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7048
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7049
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7050
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7051
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7052
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7053
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7054
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7055
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7056
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7057
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7058
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7059
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7060
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7061
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7062
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7063
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7064
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7065
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7066
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7067
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7068
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7069
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7070
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7071
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7072
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7073
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7074
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7075
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7076
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7077
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7078
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7079
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7080
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7081
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7082
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7083
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7084
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7085
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7086
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7087
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7088
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7089
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7090
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7091
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7092
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7093
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7094
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7095
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7096
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7097
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7098
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7099
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7100
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7101
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7102
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7103
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7104
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7105
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7106
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7107
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7108
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7109
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7110
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7111
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7112
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7113
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7114
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7115
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7116
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7117
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7118
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7119
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7120
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7121
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7122
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7123
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7124
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7125
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7126
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7127
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7128
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7129
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7130
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7131
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7132
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7133
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7134
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7135
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7136
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7137
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7138
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7139
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7140
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7141
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7142
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7143
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7144
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7145
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7146
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7147
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7148
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7149
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7150
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7151
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7152
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7153
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7154
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7155
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7156
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7157
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7158
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7159
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7160
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7161
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7162
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7163
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7164
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7165
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7166
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7167
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7168
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7169
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7170
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7171
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7172
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7173
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7174
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7175
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7176
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7177
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7178
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7179
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7180
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7181
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7182
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7183
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7184
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7185
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7186
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7187
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7188
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7189
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7190
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7191
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7192
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7193
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7194
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7195
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7196
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7197
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7198
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7199
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7200
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7201
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7202
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7203
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 7204
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee062000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7205
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 7206
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7207
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7208
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7209
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7210
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7211
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7212
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7213
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7214
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7215
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7216
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7217
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7218
          },
          {
            "timestamp": "2026-05-28 22:32:56,075",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7219
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7220
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7221
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7222
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7223
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7224
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7225
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7226
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7227
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7228
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7229
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7230
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7231
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7232
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7233
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7234
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7235
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7236
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7237
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7238
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7239
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7240
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7241
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 7242
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee073000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7243
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 7244
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7245
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7246
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7247
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7248
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7249
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7250
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7251
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7252
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7253
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7254
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7255
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7256
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7257
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7258
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7259
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7260
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7261
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7262
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7263
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7264
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7265
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7266
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7267
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7268
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7269
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7270
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7271
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7272
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7273
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7274
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7275
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7276
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7277
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7278
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7279
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7280
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7281
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7282
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7283
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7284
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7285
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7286
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7287
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7288
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7289
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7290
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7291
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7292
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7293
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7294
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7295
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7296
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7297
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7298
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7299
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7300
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7301
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7302
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7303
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7304
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7305
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7306
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7307
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7308
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7309
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7310
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7311
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7312
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7313
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7314
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7315
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7316
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7317
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7318
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7319
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7320
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7321
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7322
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7323
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7324
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7325
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7326
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7327
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7328
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7329
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7330
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7331
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7332
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7333
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7334
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7335
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7336
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7337
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7338
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7339
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7340
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7341
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7342
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7343
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7344
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7345
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7346
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7347
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7348
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7349
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7350
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7351
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7352
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7353
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7354
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7355
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7356
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7357
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7358
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7359
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7360
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7361
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7362
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7363
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7364
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7365
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7366
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7367
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7368
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7369
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7370
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7371
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7372
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7373
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7374
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7375
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7376
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7377
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7378
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7379
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7380
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7381
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7382
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7383
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7384
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7385
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7386
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7387
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7388
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7389
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7390
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7391
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7392
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7393
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 7394
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee07c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7395
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 7396
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7397
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7398
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7399
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7400
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7401
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7402
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7403
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7404
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7405
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7406
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7407
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7408
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7409
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7410
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 7411
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee09d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7412
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 7413
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7414
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7415
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7416
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7417
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7418
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7419
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7420
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7421
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7422
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7423
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7424
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7425
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7426
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7427
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7428
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7429
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7430
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7431
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7432
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7433
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7434
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7435
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7436
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7437
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7438
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7439
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7440
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7441
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7442
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7443
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7444
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 7445
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0a6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7446
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 7447
          },
          {
            "timestamp": "2026-05-28 22:32:56,090",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7448
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7449
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7450
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7451
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7452
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7453
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7454
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7455
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7456
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7457
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7458
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7459
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7460
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7461
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7462
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7463
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7464
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7465
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7466
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7467
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7468
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7469
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7470
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7471
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7472
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7473
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7474
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7475
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7476
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7477
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7478
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7479
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7480
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7481
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7482
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7483
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7484
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7485
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7486
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7487
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7488
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7489
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7490
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7491
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7492
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7493
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7494
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7495
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7496
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7497
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7498
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7499
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7500
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7501
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7502
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7503
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7504
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7505
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7506
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7507
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7508
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7509
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7510
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7511
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7512
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7513
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7514
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7515
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7516
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7517
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7518
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7519
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7520
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7521
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7522
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7523
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7524
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7525
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7526
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7527
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7528
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7529
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7530
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7531
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7532
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7533
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7534
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7535
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7536
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7537
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7538
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7539
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7540
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7541
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7542
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7543
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7544
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7545
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7546
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 7547
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0af000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7548
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 0,
            "id": 7549
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7550
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7551
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7552
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7553
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7554
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000354"
              }
            ],
            "repeated": 1,
            "id": 7555
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 0,
            "id": 7556
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 7557
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7558
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7559
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7560
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7561
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7562
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7563
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7564
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7565
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7566
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7567
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7568
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7569
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7570
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7571
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7572
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7573
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7574
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7575
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7576
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7577
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7578
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7579
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7580
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7581
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7582
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7583
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003bc"
              }
            ],
            "repeated": 1,
            "id": 7584
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7585
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7586
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7587
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7588
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7589
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7590
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7591
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7592
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7593
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7594
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7595
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7596
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7597
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7598
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7599
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7600
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7601
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7602
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7603
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7604
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7605
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7606
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7607
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7608
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7609
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7610
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7611
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7612
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7613
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7614
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7615
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7616
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7617
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7618
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7619
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7620
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7621
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7622
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7623
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7624
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7625
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7626
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7627
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7628
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7629
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7630
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7631
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7632
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7633
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7634
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7635
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7636
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7637
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7638
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7639
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7640
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 1,
            "id": 7641
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000003c4"
              }
            ],
            "repeated": 1,
            "id": 7642
          },
          {
            "timestamp": "2026-05-28 22:32:56,106",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "system",
            "api": "NtClose",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000358"
              }
            ],
            "repeated": 0,
            "id": 7643
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0b8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7644
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0d9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7645
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0e2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7646
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0eb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7647
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0f4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7648
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0fd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7649
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee10e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7650
          },
          {
            "timestamp": "2026-05-28 22:32:56,122",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee12f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7651
          },
          {
            "timestamp": "2026-05-28 22:32:56,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee140000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7652
          },
          {
            "timestamp": "2026-05-28 22:32:56,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee161000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7653
          },
          {
            "timestamp": "2026-05-28 22:32:56,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee172000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7654
          },
          {
            "timestamp": "2026-05-28 22:32:56,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1b1000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7655
          },
          {
            "timestamp": "2026-05-28 22:32:56,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1b5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7656
          },
          {
            "timestamp": "2026-05-28 22:32:56,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1be000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7657
          },
          {
            "timestamp": "2026-05-28 22:32:56,137",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1cf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7658
          },
          {
            "timestamp": "2026-05-28 22:32:56,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7659
          },
          {
            "timestamp": "2026-05-28 22:32:56,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1eb000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7660
          },
          {
            "timestamp": "2026-05-28 22:32:56,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1f3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7661
          },
          {
            "timestamp": "2026-05-28 22:32:56,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee204000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7662
          },
          {
            "timestamp": "2026-05-28 22:32:56,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee241000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7663
          },
          {
            "timestamp": "2026-05-28 22:32:56,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee247000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7664
          },
          {
            "timestamp": "2026-05-28 22:32:56,153",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee258000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7665
          },
          {
            "timestamp": "2026-05-28 22:32:56,168",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee269000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7666
          },
          {
            "timestamp": "2026-05-28 22:32:56,168",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee28a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7667
          },
          {
            "timestamp": "2026-05-28 22:32:56,168",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2c7000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7668
          },
          {
            "timestamp": "2026-05-28 22:32:56,168",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2cd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7669
          },
          {
            "timestamp": "2026-05-28 22:32:56,168",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2d9000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7670
          },
          {
            "timestamp": "2026-05-28 22:32:56,168",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7671
          },
          {
            "timestamp": "2026-05-28 22:32:56,184",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7672
          },
          {
            "timestamp": "2026-05-28 22:32:56,184",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee312000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7673
          },
          {
            "timestamp": "2026-05-28 22:32:56,184",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee34f000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7674
          },
          {
            "timestamp": "2026-05-28 22:32:56,184",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee355000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7675
          },
          {
            "timestamp": "2026-05-28 22:32:56,200",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee366000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7676
          },
          {
            "timestamp": "2026-05-28 22:32:56,200",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee371000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7677
          },
          {
            "timestamp": "2026-05-28 22:32:56,200",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee379000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7678
          },
          {
            "timestamp": "2026-05-28 22:32:56,200",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00800000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7679
          },
          {
            "timestamp": "2026-05-28 22:32:56,200",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3d0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00044000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7680
          },
          {
            "timestamp": "2026-05-28 22:32:56,200",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee411000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7681
          },
          {
            "timestamp": "2026-05-28 22:32:56,215",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee39a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7682
          },
          {
            "timestamp": "2026-05-28 22:32:56,215",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3bb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00014000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7683
          },
          {
            "timestamp": "2026-05-28 22:32:56,215",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3c3000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7684
          },
          {
            "timestamp": "2026-05-28 22:32:56,215",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee414000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7685
          },
          {
            "timestamp": "2026-05-28 22:32:56,215",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee453000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7686
          },
          {
            "timestamp": "2026-05-28 22:32:56,215",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee457000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7687
          },
          {
            "timestamp": "2026-05-28 22:32:56,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee478000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7688
          },
          {
            "timestamp": "2026-05-28 22:32:56,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee4b5000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7689
          },
          {
            "timestamp": "2026-05-28 22:32:56,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee4bb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7690
          },
          {
            "timestamp": "2026-05-28 22:32:56,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee4c7000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7691
          },
          {
            "timestamp": "2026-05-28 22:32:56,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee4ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7692
          },
          {
            "timestamp": "2026-05-28 22:32:56,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee4e9000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7693
          },
          {
            "timestamp": "2026-05-28 22:32:56,231",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee4f1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7694
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee512000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7695
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee54b000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7696
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d4875620",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedbf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003de000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7697
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired"
              }
            ],
            "repeated": 0,
            "id": 7698
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{8B24B027-1DEE-BABB-9A95-3517DFB9C552}"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{8B24B027-1DEE-BABB-9A95-3517DFB9C552}"
              }
            ],
            "repeated": 0,
            "id": 7699
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 7700
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7701
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7702
          },
          {
            "timestamp": "2026-05-28 22:32:56,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488a128",
            "parentcaller": "0x7ff6d487564a",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7703
          },
          {
            "timestamp": "2026-05-28 22:32:58,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 7704
          },
          {
            "timestamp": "2026-05-28 22:32:58,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 7705
          },
          {
            "timestamp": "2026-05-28 22:32:58,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f329e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 7706
          },
          {
            "timestamp": "2026-05-28 22:32:58,012",
            "thread_id": "12624",
            "caller": "0x7ff6d4875778",
            "parentcaller": "0x7ff6d47d0566",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d5000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7707
          },
          {
            "timestamp": "2026-05-28 22:32:58,012",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7708
          },
          {
            "timestamp": "2026-05-28 22:32:58,012",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7709
          },
          {
            "timestamp": "2026-05-28 22:32:58,012",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7710
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x001c8000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7711
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7712
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7713
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee555000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7714
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee595000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7715
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee598000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7716
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee59b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7717
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5a4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7718
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7719
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5aa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7720
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5af000"
              },
              {
                "name": "RegionSize",
                "value": "0x00002000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7721
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5b1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7722
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5b4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7723
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5c5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7724
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5ca000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7725
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5cf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7726
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5d2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7727
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7728
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7729
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5df000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7730
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5e2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7731
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5eb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7732
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5ee000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7733
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5f3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7734
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5f6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7735
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee634000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7736
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee639000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7737
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee63c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7738
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee64d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7739
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee656000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7740
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee65b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7741
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee660000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7742
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee669000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7743
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee66c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7744
          },
          {
            "timestamp": "2026-05-28 22:32:58,075",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee671000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7745
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee67a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7746
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee67f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7747
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee690000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7748
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee699000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7749
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6a2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7750
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7751
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6aa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7752
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6e8000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7753
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6ed000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7754
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6fe000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7755
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee701000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7756
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee706000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7757
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee70f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7758
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee714000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7759
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee725000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7760
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee72e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7761
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee733000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7762
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee73c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7763
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee741000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7764
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee752000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7765
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee78e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7766
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee795000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7767
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee79e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7768
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7af000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7769
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7b4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7770
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7c5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7771
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7772
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7df000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7773
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7e2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7774
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7e7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7775
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7776
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee811000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7777
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee84c000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7778
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee854000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7779
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee865000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7780
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee86e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7781
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee87f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7782
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee888000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7783
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee891000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7784
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee8ca000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7785
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee8d4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7786
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee8e5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7787
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee8f6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7788
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee907000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7789
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee910000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7790
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee931000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7791
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee934000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7792
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee952000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7793
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee957000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7794
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee994000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7795
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee99a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7796
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9a3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7797
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9ae000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7798
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9b6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7799
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9bf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7800
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7801
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9d9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7802
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9fa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7803
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea34000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7804
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea3d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7805
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea48000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7806
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea50000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7807
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea61000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7808
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea7a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7809
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea84000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7810
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea8d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7811
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea9e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7812
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeadc000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7813
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeae1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7814
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeaee000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7815
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeaf4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7816
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb15000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7817
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb26000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7818
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb42000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7819
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb49000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7820
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb5a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7821
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb98000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7822
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb9d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7823
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebaa000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7824
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebb0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7825
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebc1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7826
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef450000"
              },
              {
                "name": "RegionSize",
                "value": "0x00fd0000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7827
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef450000"
              },
              {
                "name": "RegionSize",
                "value": "0x00044000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7828
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef491000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7829
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef494000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7830
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4d3000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7831
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7832
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4f5000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7833
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4fa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7834
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef507000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7835
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef50d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7836
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef51e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7837
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef53f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7838
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef550000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7839
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef589000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7840
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef593000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7841
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef59b000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7842
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5a6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7843
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5c5000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7844
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7845
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 7846
          },
          {
            "timestamp": "2026-05-28 22:32:58,090",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 7847
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5c9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7848
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5d2000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7849
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5e3000"
              },
              {
                "name": "RegionSize",
                "value": "0x00022000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7850
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef605000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7851
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef648000"
              },
              {
                "name": "RegionSize",
                "value": "0x00086000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7852
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0010e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7853
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7854
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedaed000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7855
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedaf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00226000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7856
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedaf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7857
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedd15000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7858
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0010e000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7859
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0043a000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7860
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7861
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef009000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7862
          },
          {
            "timestamp": "2026-05-28 22:32:58,106",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedaf0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00226000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7863
          },
          {
            "timestamp": "2026-05-28 22:32:58,122",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d6000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7864
          },
          {
            "timestamp": "2026-05-28 22:32:58,122",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7865
          },
          {
            "timestamp": "2026-05-28 22:32:58,122",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceddb5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7866
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef010000"
              },
              {
                "name": "RegionSize",
                "value": "0x003de000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7867
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef010000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7868
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef3ed000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7869
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d6000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7870
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0043a000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7871
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003df000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7872
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7873
          },
          {
            "timestamp": "2026-05-28 22:32:58,137",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceddbe000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7874
          },
          {
            "timestamp": "2026-05-28 22:32:58,168",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef617000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7875
          },
          {
            "timestamp": "2026-05-28 22:32:58,168",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef629000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7876
          },
          {
            "timestamp": "2026-05-28 22:32:58,168",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef66b000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7877
          },
          {
            "timestamp": "2026-05-28 22:32:58,184",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef68d000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7878
          },
          {
            "timestamp": "2026-05-28 22:32:58,184",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef69f000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7879
          },
          {
            "timestamp": "2026-05-28 22:32:58,184",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7880
          },
          {
            "timestamp": "2026-05-28 22:32:58,184",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef70e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7881
          },
          {
            "timestamp": "2026-05-28 22:32:58,200",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef711000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7882
          },
          {
            "timestamp": "2026-05-28 22:32:58,200",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef750000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7883
          },
          {
            "timestamp": "2026-05-28 22:32:58,200",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef754000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7884
          },
          {
            "timestamp": "2026-05-28 22:32:58,200",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef792000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7885
          },
          {
            "timestamp": "2026-05-28 22:32:58,200",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef797000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7886
          },
          {
            "timestamp": "2026-05-28 22:32:58,200",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7d4000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7887
          },
          {
            "timestamp": "2026-05-28 22:32:58,200",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6b9000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7888
          },
          {
            "timestamp": "2026-05-28 22:32:58,215",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7da000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7889
          },
          {
            "timestamp": "2026-05-28 22:32:58,215",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7f6000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7890
          },
          {
            "timestamp": "2026-05-28 22:32:58,215",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7fd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7891
          },
          {
            "timestamp": "2026-05-28 22:32:58,215",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef838000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7892
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef840000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7893
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef84a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7894
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef853000"
              },
              {
                "name": "RegionSize",
                "value": "0x00011000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7895
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef864000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7896
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef89c000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7897
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8a7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7898
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8de000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7899
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8ea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7900
          },
          {
            "timestamp": "2026-05-28 22:32:58,231",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef900000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7901
          },
          {
            "timestamp": "2026-05-28 22:32:58,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef90d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7902
          },
          {
            "timestamp": "2026-05-28 22:32:58,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef912000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7903
          },
          {
            "timestamp": "2026-05-28 22:32:58,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef920000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7904
          },
          {
            "timestamp": "2026-05-28 22:32:58,247",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef954000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7905
          },
          {
            "timestamp": "2026-05-28 22:32:58,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef963000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7906
          },
          {
            "timestamp": "2026-05-28 22:32:58,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef996000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7907
          },
          {
            "timestamp": "2026-05-28 22:32:58,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9a6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7908
          },
          {
            "timestamp": "2026-05-28 22:32:58,262",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9a8000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7909
          },
          {
            "timestamp": "2026-05-28 22:32:58,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9b9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7910
          },
          {
            "timestamp": "2026-05-28 22:32:58,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9ea000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7911
          },
          {
            "timestamp": "2026-05-28 22:32:58,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9fc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7912
          },
          {
            "timestamp": "2026-05-28 22:32:58,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa0c000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7913
          },
          {
            "timestamp": "2026-05-28 22:32:58,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa1f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7914
          },
          {
            "timestamp": "2026-05-28 22:32:58,278",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa4e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7915
          },
          {
            "timestamp": "2026-05-28 22:32:58,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa60000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7916
          },
          {
            "timestamp": "2026-05-28 22:32:58,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa62000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7917
          },
          {
            "timestamp": "2026-05-28 22:32:58,293",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefaa2000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7918
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefaa5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7919
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefac4000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7920
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefac8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7921
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb06000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7922
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb0b000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7923
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb48000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7924
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb4e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7925
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb5a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7926
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb61000"
              },
              {
                "name": "RegionSize",
                "value": "0x00021000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7927
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced9e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003df000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7928
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef010000"
              },
              {
                "name": "RegionSize",
                "value": "0x003de000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 7929
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef66b000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7930
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef617000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7931
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef69f000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7932
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef629000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7933
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7d4000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7934
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef70e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7935
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef838000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7936
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef750000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7937
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00094000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7938
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00082000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7939
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef794000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7940
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7f8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7941
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef68f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7942
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef84c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7943
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6bb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7944
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb7c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7945
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebc6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7946
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7f6000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7947
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef794000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7948
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7f8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7949
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef68d000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7950
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00094000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7951
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef68f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7952
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef84a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7953
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef84c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7954
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6b9000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7955
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6bb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7956
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef954000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7957
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8de000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7958
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef996000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7959
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef89c000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7960
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef794000"
              },
              {
                "name": "RegionSize",
                "value": "0x0014a000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7961
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9a8000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7962
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x000ed000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7963
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef914000"
              },
              {
                "name": "RegionSize",
                "value": "0x00094000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7964
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef912000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7965
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef914000"
              },
              {
                "name": "RegionSize",
                "value": "0x00094000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7966
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa0c000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7967
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef900000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7968
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9ea000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7969
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8de000"
              },
              {
                "name": "RegionSize",
                "value": "0x0012e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7970
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa4e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7971
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef792000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7972
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00082000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7973
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefaa2000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7974
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x000c5000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7975
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa0d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00041000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7976
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa62000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 7977
          },
          {
            "timestamp": "2026-05-28 22:32:58,309",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb06000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7978
          },
          {
            "timestamp": "2026-05-28 22:32:58,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb48000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7979
          },
          {
            "timestamp": "2026-05-28 22:32:58,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa62000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7980
          },
          {
            "timestamp": "2026-05-28 22:32:58,325",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefaa2000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7981
          },
          {
            "timestamp": "2026-05-28 22:32:58,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa0d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00041000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7982
          },
          {
            "timestamp": "2026-05-28 22:32:58,340",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefa4d000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7983
          },
          {
            "timestamp": "2026-05-28 22:32:58,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb06000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7984
          },
          {
            "timestamp": "2026-05-28 22:32:58,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x000c5000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7985
          },
          {
            "timestamp": "2026-05-28 22:32:58,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef70e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7986
          },
          {
            "timestamp": "2026-05-28 22:32:58,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef750000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7987
          },
          {
            "timestamp": "2026-05-28 22:32:58,356",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef792000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7988
          },
          {
            "timestamp": "2026-05-28 22:32:58,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb18000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7989
          },
          {
            "timestamp": "2026-05-28 22:32:58,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb3a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7990
          },
          {
            "timestamp": "2026-05-28 22:32:58,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef5d7000"
              },
              {
                "name": "RegionSize",
                "value": "0x000ed000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7991
          },
          {
            "timestamp": "2026-05-28 22:32:58,372",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef617000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7992
          },
          {
            "timestamp": "2026-05-28 22:32:58,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef629000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7993
          },
          {
            "timestamp": "2026-05-28 22:32:58,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef66b000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7994
          },
          {
            "timestamp": "2026-05-28 22:32:58,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6ad000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7995
          },
          {
            "timestamp": "2026-05-28 22:32:58,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef794000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7996
          },
          {
            "timestamp": "2026-05-28 22:32:58,387",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7b4000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7997
          },
          {
            "timestamp": "2026-05-28 22:32:58,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6bf000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7998
          },
          {
            "timestamp": "2026-05-28 22:32:58,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7b7000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 7999
          },
          {
            "timestamp": "2026-05-28 22:32:58,403",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7f6000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8000
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef7fa000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8001
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef838000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8002
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef83d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8003
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef84a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8004
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef850000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8005
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef88c000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8006
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef893000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8007
          },
          {
            "timestamp": "2026-05-28 22:32:58,418",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8ae000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8008
          },
          {
            "timestamp": "2026-05-28 22:32:58,434",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8b6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8009
          },
          {
            "timestamp": "2026-05-28 22:32:58,434",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8f0000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8010
          },
          {
            "timestamp": "2026-05-28 22:32:58,434",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef8f9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8011
          },
          {
            "timestamp": "2026-05-28 22:32:58,434",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef902000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8012
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef90c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8013
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef944000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8014
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef94f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00023000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8015
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef966000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8016
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef972000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8017
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9a8000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8018
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9b5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00013000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8019
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9ba000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8020
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9c8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00044000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8021
          },
          {
            "timestamp": "2026-05-28 22:32:58,450",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9fc000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8022
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee634000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8023
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee595000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8024
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x000cb000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8025
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee555000"
              },
              {
                "name": "RegionSize",
                "value": "0x00059000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8026
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6ea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00025000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8027
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee68c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8028
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef9fe000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8029
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb3c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8030
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee255000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8031
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8032
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8033
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3cd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8034
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x000cb000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8035
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee68c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8036
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6ea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00025000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8037
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee255000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8038
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee78e000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8039
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee6e8000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8040
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee5b0000"
              },
              {
                "name": "RegionSize",
                "value": "0x001de000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8041
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee8ca000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8042
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee88a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00050000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8043
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8044
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee86a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8045
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee78f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8046
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee84e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00017000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8047
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8048
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee253000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8049
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8050
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee84c000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8051
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee84e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00017000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8052
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee88a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00050000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8053
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee86a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8054
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7e0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8055
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8056
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8057
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9ae000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8058
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea34000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8059
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee994000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8060
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee7ac000"
              },
              {
                "name": "RegionSize",
                "value": "0x000dd000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8061
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee88a000"
              },
              {
                "name": "RegionSize",
                "value": "0x000a5000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8062
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee954000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8063
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9f4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8064
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee99e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00031000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8065
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee99e000"
              },
              {
                "name": "RegionSize",
                "value": "0x00031000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8066
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee952000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8067
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee954000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8068
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9f4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8069
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee88a000"
              },
              {
                "name": "RegionSize",
                "value": "0x000a5000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8070
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee88a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00165000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8071
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea48000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8072
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeaee000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8073
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea7a000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8074
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb98000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8075
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeadc000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8076
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea8c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00083000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8077
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9f4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00054000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8078
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb58000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8079
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea4a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00038000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8080
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea8c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00083000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8081
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebaa000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8082
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb58000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8083
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea4a000"
              },
              {
                "name": "RegionSize",
                "value": "0x00038000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8084
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee78f000"
              },
              {
                "name": "RegionSize",
                "value": "0x00018000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8085
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4f5000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8086
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb42000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8087
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceea4a000"
              },
              {
                "name": "RegionSize",
                "value": "0x0010d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8088
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef507000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8089
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e23d",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x001c8000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 8090
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee555000"
              },
              {
                "name": "RegionSize",
                "value": "0x00059000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8091
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0e6000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8092
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceeb58000"
              },
              {
                "name": "RegionSize",
                "value": "0x0006d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8093
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee555000"
              },
              {
                "name": "RegionSize",
                "value": "0x0005a000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8094
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00032000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8095
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee78f000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8096
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8097
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0be000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8098
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef539000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8099
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0de000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8100
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced08c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8101
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced098000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8102
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0b8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8103
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced096000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8104
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0da000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8105
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced03c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8106
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0be000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8107
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0de000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8108
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0da000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8109
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00032000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8110
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfd1000"
              },
              {
                "name": "RegionSize",
                "value": "0x0004b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8111
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8112
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee071000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8113
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0be000"
              },
              {
                "name": "RegionSize",
                "value": "0x0002f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8114
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee035000"
              },
              {
                "name": "RegionSize",
                "value": "0x0002b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8115
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0b5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8116
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee021000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8117
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee071000"
              },
              {
                "name": "RegionSize",
                "value": "0x0003f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8118
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0b5000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8119
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee021000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8120
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee035000"
              },
              {
                "name": "RegionSize",
                "value": "0x0002b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8121
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfd1000"
              },
              {
                "name": "RegionSize",
                "value": "0x0004b000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8122
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedfd1000"
              },
              {
                "name": "RegionSize",
                "value": "0x0010b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8123
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1b1000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8124
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0e5000"
              },
              {
                "name": "RegionSize",
                "value": "0x000cc000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8125
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4d3000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8126
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef4d5000"
              },
              {
                "name": "RegionSize",
                "value": "0x00043000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8127
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1eb000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8128
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2c7000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8129
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee241000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8130
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1bb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00086000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8131
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef493000"
              },
              {
                "name": "RegionSize",
                "value": "0x00085000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8132
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee283000"
              },
              {
                "name": "RegionSize",
                "value": "0x00044000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8133
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee1bb000"
              },
              {
                "name": "RegionSize",
                "value": "0x00086000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8134
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee253000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8135
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee283000"
              },
              {
                "name": "RegionSize",
                "value": "0x00044000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8136
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2d9000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8137
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0e5000"
              },
              {
                "name": "RegionSize",
                "value": "0x000cc000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8138
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee0dc000"
              },
              {
                "name": "RegionSize",
                "value": "0x00185000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8139
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee411000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8140
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee262000"
              },
              {
                "name": "RegionSize",
                "value": "0x00088000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8141
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3d1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8142
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2ef000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8143
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee351000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8144
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee34f000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8145
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2ef000"
              },
              {
                "name": "RegionSize",
                "value": "0x0001f000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8146
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee351000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8147
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced08c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00008000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8148
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced096000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8149
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3c3000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8150
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee371000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8151
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3cd000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8152
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee4b5000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8153
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee2ef000"
              },
              {
                "name": "RegionSize",
                "value": "0x000df000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8154
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee475000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8155
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced08c000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8156
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee54d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 8157
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee453000"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000001",
                "pretty_value": "PAGE_NOACCESS"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8158
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee3d1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00040000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8159
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8160
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "E60687F7-01A1-40AA-86AC-DB1CBF673334"
              },
              {
                "name": "ClsContext",
                "value": "0x00008005",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_LOCAL_SERVER|CLSCTX_DISABLE_AAA"
              },
              {
                "name": "riid",
                "value": "9FC14B6B-EC4B-427C-8AAF-A128D33EE310"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8161
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8162
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d488e2b3",
            "parentcaller": "0x7ff6d4882461",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 1,
            "id": 8163
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8164
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 8165
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 8166
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8167
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8168
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8169
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 8170
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 8171
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8172
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8173
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8174
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 8175
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 8176
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8177
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8178
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8179
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8180
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8181
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8182
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8183
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8184
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8185
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8186
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8187
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8188
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8189
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8190
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8191
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8192
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8193
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8194
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8195
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8196
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8197
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8198
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8199
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8200
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8201
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8202
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8203
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8204
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8205
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8206
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48ce5e8",
            "parentcaller": "0x7ff6d489f276",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000364"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8207
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8208
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "isV2Provider"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\isV2Provider"
              }
            ],
            "repeated": 0,
            "id": 8209
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d489d800",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8210
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489fade",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8211
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489fade",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "queuedTime"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime"
              }
            ],
            "repeated": 0,
            "id": 8212
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d489fade",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8213
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8214
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8215
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8216
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "queuedTime"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime"
              }
            ],
            "repeated": 0,
            "id": 8217
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8218
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820db4",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8219
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820db4",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8220
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820db4",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8221
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820db4",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "queuedTime"
              },
              {
                "name": "Data",
                "value": "\\xcc\\x9a\\xf59\\x00\\xef\\xdc\\x01"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime"
              }
            ],
            "repeated": 0,
            "id": 8222
          },
          {
            "timestamp": "2026-05-28 22:32:58,465",
            "thread_id": "12624",
            "caller": "0x7ff6d4820db4",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8223
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8224
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8225
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8226
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "cmdLine"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\cmdLine"
              }
            ],
            "repeated": 0,
            "id": 8227
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8228
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8229
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8230
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8231
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "cmdLine"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\usoclient.exe"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\cmdLine"
              }
            ],
            "repeated": 0,
            "id": 8232
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8233
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8234
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "startArg"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg"
              }
            ],
            "repeated": 0,
            "id": 8235
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8236
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8237
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8238
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8239
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "startArg"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg"
              }
            ],
            "repeated": 0,
            "id": 8240
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8241
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8242
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8243
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8244
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "startArg"
              },
              {
                "name": "Data",
                "value": "StartStoreUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg"
              }
            ],
            "repeated": 0,
            "id": 8245
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8246
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8247
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "pauseArg"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg"
              }
            ],
            "repeated": 0,
            "id": 8248
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8249
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8250
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8251
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8252
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "pauseArg"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg"
              }
            ],
            "repeated": 0,
            "id": 8253
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8254
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8255
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8256
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8257
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "pauseArg"
              },
              {
                "name": "Data",
                "value": "PauseStoreUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg"
              }
            ],
            "repeated": 0,
            "id": 8258
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8259
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48182dd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8260
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48182dd",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "workCompleted"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted"
              }
            ],
            "repeated": 0,
            "id": 8261
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d48182dd",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8262
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8263
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8264
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8265
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "workCompleted"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted"
              }
            ],
            "repeated": 0,
            "id": 8266
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8267
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8268
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8269
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8270
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "workCompleted"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted"
              }
            ],
            "repeated": 0,
            "id": 8271
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8272
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489ce2e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8273
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489ce2e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterOOBEDurationInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes"
              }
            ],
            "repeated": 0,
            "id": 8274
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d489ce2e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8275
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8276
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8277
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8278
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterOOBEDurationInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes"
              }
            ],
            "repeated": 0,
            "id": 8279
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8280
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8281
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8282
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8283
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterOOBEDurationInMinutes"
              },
              {
                "name": "Data",
                "value": "7200"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes"
              }
            ],
            "repeated": 0,
            "id": 8284
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8285
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489d017",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8286
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489d017",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterPriority"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority"
              }
            ],
            "repeated": 0,
            "id": 8287
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d489d017",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8288
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8289
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8290
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8291
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterPriority"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority"
              }
            ],
            "repeated": 0,
            "id": 8292
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8293
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8294
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8295
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8296
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterPriority"
              },
              {
                "name": "Data",
                "value": "9"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority"
              }
            ],
            "repeated": 0,
            "id": 8297
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8298
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d47cdf26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8299
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d47cdf26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterBehindSlaInDays"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays"
              }
            ],
            "repeated": 0,
            "id": 8300
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d47cdf26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8301
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8302
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8303
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8304
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterBehindSlaInDays"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays"
              }
            ],
            "repeated": 0,
            "id": 8305
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8306
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8307
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8308
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8309
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterBehindSlaInDays"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays"
              }
            ],
            "repeated": 0,
            "id": 8310
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8311
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489d397",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8312
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489d397",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "updaterDisabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterDisabled"
              }
            ],
            "repeated": 0,
            "id": 8313
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d489d397",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8314
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d489d582",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia"
              }
            ],
            "repeated": 0,
            "id": 8315
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d489d582",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "scanFrequency"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\scanFrequency"
              }
            ],
            "repeated": 0,
            "id": 8316
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d489d582",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8317
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48255b2",
            "parentcaller": "0x7ff6d48a0d32",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\Setup"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup"
              }
            ],
            "repeated": 0,
            "id": 8318
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48255b2",
            "parentcaller": "0x7ff6d48a0d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "SetupSupported"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupSupported"
              }
            ],
            "repeated": 0,
            "id": 8319
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48255b2",
            "parentcaller": "0x7ff6d48a0d32",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8320
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48255b2",
            "parentcaller": "0x7ff6d48a0d32",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SYSTEM\\CurrentControlSet\\Control\\WinInit"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WinInit"
              }
            ],
            "repeated": 0,
            "id": 8321
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48255b2",
            "parentcaller": "0x7ff6d48a0d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "Headless"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\WinInit\\Headless"
              }
            ],
            "repeated": 0,
            "id": 8322
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48255b2",
            "parentcaller": "0x7ff6d48a0d32",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8323
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 8324
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 8325
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8326
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8327
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8328
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8329
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8330
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8331
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47eecfe",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8332
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47d088c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8333
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47d088c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8334
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47d088c",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000204"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000002",
                "pretty_value": "KEY_SET_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 8335
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47d088c",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              },
              {
                "name": "ValueName",
                "value": "UpdateManagerCtorFailures"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "0"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures"
              }
            ],
            "repeated": 0,
            "id": 8336
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d47d088c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000204"
              }
            ],
            "repeated": 0,
            "id": 8337
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d47cdf26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WindowsUpdate\\UX\\RebootDowntime"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\RebootDowntime"
              }
            ],
            "repeated": 1,
            "id": 8338
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d47e3a45",
            "parentcaller": "0x7ff6d47dfe75",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003d2000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 8339
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d47f4fba",
            "parentcaller": "0x7ff6d47d0ecc",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000204"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18cef5919d0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "Module",
                "value": "ucrtbase.dll"
              }
            ],
            "repeated": 0,
            "id": 8340
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12624",
            "caller": "0x7ff6d47f4fba",
            "parentcaller": "0x7ff6d47d0ecc",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000204",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18cef5919d0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              }
            ],
            "repeated": 0,
            "id": 8341
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12928",
            "caller": "0x7fff98c5e715",
            "parentcaller": "0x7fff98c5e37b",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb4e8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8342
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12928",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8343
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12928",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18cef5919d0"
              }
            ],
            "repeated": 0,
            "id": 8344
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12928",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff9634c050",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-appmodel-runtime-l1-1-2"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff94210000"
              }
            ],
            "repeated": 0,
            "id": 8345
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12928",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff9634c050",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff94210000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-appmodel-runtime-l1-1-2"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 8346
          },
          {
            "timestamp": "2026-05-28 22:32:58,481",
            "thread_id": "12928",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff96353594",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "kernel.appcore.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff94210000"
              },
              {
                "name": "FunctionName",
                "value": "AppPolicyGetThreadInitializationType"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff94213100"
              }
            ],
            "repeated": 0,
            "id": 8347
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4824b85",
            "parentcaller": "0x7ff6d48233ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8348
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4824b85",
            "parentcaller": "0x7ff6d48233ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8A1A8BB1-242F-431A-9F5B-254BA754631C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "42C75F29-D5E0-4DB3-95E1-7494DE083789"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8349
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d48233c1",
            "parentcaller": "0x7ff6d47d5dc1",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8350
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d48233c1",
            "parentcaller": "0x7ff6d47d5dc1",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8351
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 8352
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 8353
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 8354
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 8355
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 8356
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlRegisterFeatureConfigurationChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c593b0"
              }
            ],
            "repeated": 0,
            "id": 8357
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQueryWnfStateData"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cefc40"
              }
            ],
            "repeated": 0,
            "id": 8358
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlSubscribeWnfStateChangeNotification"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92460"
              }
            ],
            "repeated": 0,
            "id": 8359
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDisownModuleHeapAllocation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ccfa30"
              }
            ],
            "repeated": 0,
            "id": 8360
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlQueryFeatureConfiguration"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cacbd0"
              }
            ],
            "repeated": 0,
            "id": 8361
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlDllShutdownInProgress"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cb3410"
              }
            ],
            "repeated": 0,
            "id": 8362
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "synchronization",
            "api": "NtCreateMutant",
            "status": true,
            "return": "0x40000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000404"
              },
              {
                "name": "MutexName",
                "value": "Local\\SM0:8032:304:WilStaging_02"
              },
              {
                "name": "InitialOwner",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8363
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000404"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8364
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8365
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000408"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8366
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8367
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000040c"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8368
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "synchronization",
            "api": "NtReleaseMutant",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000404"
              }
            ],
            "repeated": 0,
            "id": 8369
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8370
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8371
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 8372
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8373
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8374
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 8375
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 8376
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "policymanager.dll"
              }
            ],
            "repeated": 0,
            "id": 8377
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\policymanager.dll"
              }
            ],
            "repeated": 0,
            "id": 8378
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\policymanager.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8379
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000404"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000040c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\policymanager.dll"
              }
            ],
            "repeated": 0,
            "id": 8380
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000404"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90020000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x000a1000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8381
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8382
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8383
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8384
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8385
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8386
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8387
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "msvcp110_win.dll"
              }
            ],
            "repeated": 0,
            "id": 8388
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msvcp110_win.dll"
              }
            ],
            "repeated": 0,
            "id": 8389
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msvcp110_win.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8390
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000040c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x00000410"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\msvcp110_win.dll"
              }
            ],
            "repeated": 0,
            "id": 8391
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x0000040c"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff953c0000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0008a000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8392
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8393
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8394
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8395
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8396
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8397
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90098000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8398
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "35"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0e\\x00\\x00\\x00\r\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xa0\\xe2\\x02\\xed\\x8c\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x97\\x88\\xee\\x8c\\x01\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x10#\\x97\\xff\\x7f\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8399
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9540d000"
              },
              {
                "name": "ModuleName",
                "value": "msvcp110_win.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8400
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\msvcp110_win"
              },
              {
                "name": "DllBase",
                "value": "0x7fff953c0000"
              }
            ],
            "repeated": 0,
            "id": 8401
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\policymanager"
              },
              {
                "name": "DllBase",
                "value": "0x7fff90020000"
              }
            ],
            "repeated": 0,
            "id": 8402
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb4e9000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8403
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\msvcp110_win"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff953c0000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff95405870"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 8404
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\policymanager"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff90020000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff90029ed0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 8405
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff873f0000"
              },
              {
                "name": "ModuleName",
                "value": "UpdatePolicy.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8406
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff873f0000"
              },
              {
                "name": "ModuleName",
                "value": "UpdatePolicy.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8407
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8408
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8409
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 8410
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 8411
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 8412
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 8413
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 8414
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 8415
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 8416
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 8417
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 8418
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 8419
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 8420
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8421
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8422
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 8423
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8424
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8425
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 8426
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 8427
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 8428
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 8429
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 8430
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000404"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 8431
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000404"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 8432
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000404"
              }
            ],
            "repeated": 0,
            "id": 8433
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8434
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 8435
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 8436
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 8437
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8438
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 8439
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 8440
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8441
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8442
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 8443
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8444
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8445
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 8446
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 8447
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 8448
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 8449
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 8450
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 8451
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 8452
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000410"
              }
            ],
            "repeated": 0,
            "id": 8453
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8454
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4845ea5",
            "parentcaller": "0x7ff6d4846171",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "43"
              },
              {
                "name": "InputBuffer",
                "value": "\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x14\\x00\\x16\\x00\\x00\\x00\\x00\\x00\\xa0\\xdf\\x02\\xed\\x8c\\x01\\x00\\x00\\xa0\\xe0\\x02\\xed\\x8c\\x01\\x00\\x00M\\x00o\\x00n\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": "\\x10\\x04\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8455
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4845ec5",
            "parentcaller": "0x7ff6d4846171",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "44"
              },
              {
                "name": "InputBuffer",
                "value": "\\x10\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8456
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 8457
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 8458
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 8459
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 8460
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 8461
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 8462
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 8463
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8464
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8465
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 8466
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8467
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8468
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 8469
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency"
              },
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency"
              }
            ],
            "repeated": 0,
            "id": 8470
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 8471
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 8472
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 8473
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 8474
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "ValueName",
                "value": "DetectionFrequency"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\DetectionFrequency"
              }
            ],
            "repeated": 0,
            "id": 8475
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 8476
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8477
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8478
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\n\\x0by\\x00\\x14\\x0b9\\x00\\x0b9\\x0f\\x14\\x0e\\x8e\\x0e\\xd8\\x0e\\\\x0f\\xbc\\x0e$\r\\x96\r\\xe4\r`\\x0f\\x80\r0\\x0c\\xb2\\x0c\\xf8\\x0c\\x84\\x0fH\\x0cX\\x0b\\xe2\\x0c$\\x0b\\xb8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 8479
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8480
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8481
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8482
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8483
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8484
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff9709fbe4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}"
              }
            ],
            "repeated": 0,
            "id": 8485
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x7fff9709fa51",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000418"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8486
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x7fff9709fa8c",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{11F11442-3359-410C-875E-D21984507B62}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8487
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 8488
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 8489
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 8490
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x7fff9709fae4",
            "parentcaller": "0x7fff970642ab",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8491
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a8"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              }
            ],
            "repeated": 0,
            "id": 8492
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8493
          },
          {
            "timestamp": "2026-05-28 22:32:58,497",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000418"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 8494
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 8495
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 8496
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8497
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 8498
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Orchestrator Core Service Proxy Stub"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8499
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 8500
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 8501
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8502
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8503
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8504
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\usoapi.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8505
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 8506
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 8507
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8508
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9702855f",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 8509
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8510
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 8511
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000418"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 8512
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8513
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency"
              },
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency"
              }
            ],
            "repeated": 0,
            "id": 8514
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff97028010",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8515
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7fff90027f7e",
            "parentcaller": "0x7fff873d2b0c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 8516
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 8517
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8518
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8519
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 8520
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff97027b74",
            "parentcaller": "0x7fff970253d4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a8"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              }
            ],
            "repeated": 0,
            "id": 8521
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000414"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 8522
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8523
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000418"
              },
              {
                "name": "ObjectAttributesName",
                "value": "TreatAs"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 8524
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e238",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 8525
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff970b22e1",
            "parentcaller": "0x7fff97027c1d",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              },
              {
                "name": "KeyInformationClass",
                "value": "3"
              }
            ],
            "repeated": 0,
            "id": 8526
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970281f5",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 8527
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8528
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "Orchestrator Core Service Proxy Stub"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8529
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff97028485",
            "parentcaller": "0x7fff9702829e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000418"
              },
              {
                "name": "SubKey",
                "value": "InprocServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000420"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 8530
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000420"
              },
              {
                "name": "ValueName",
                "value": "InprocServer32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\InprocServer32"
              }
            ],
            "repeated": 0,
            "id": 8531
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702870d",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000420"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8532
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff970287bc",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000420"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\usoapi.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8533
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff97028d32",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000420"
              },
              {
                "name": "ValueName",
                "value": "ThreadingModel"
              },
              {
                "name": "Data",
                "value": "Both"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\ThreadingModel"
              }
            ],
            "repeated": 0,
            "id": 8534
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000420"
              }
            ],
            "repeated": 0,
            "id": 8535
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8536
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000418"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler32"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InprocHandler32"
              }
            ],
            "repeated": 0,
            "id": 8537
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8538
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000418"
              },
              {
                "name": "ObjectAttributesName",
                "value": "InprocHandler"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InprocHandler"
              }
            ],
            "repeated": 0,
            "id": 8539
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9702ab08",
            "parentcaller": "0x7fff9702a7d9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000418"
              },
              {
                "name": "SubKey",
                "value": "LocalServer32"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\LocalServer32"
              }
            ],
            "repeated": 0,
            "id": 8540
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96502e92",
            "parentcaller": "0x7fff9702a825",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AppID"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\AppID"
              }
            ],
            "repeated": 0,
            "id": 8541
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965040c4",
            "parentcaller": "0x7fff96503f4b",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8542
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000418"
              },
              {
                "name": "ObjectAttributesName",
                "value": "LocalServer"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\LocalServer"
              }
            ],
            "repeated": 0,
            "id": 8543
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9702ad16",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002a8"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              },
              {
                "name": "Handle",
                "value": "0x00000424"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              }
            ],
            "repeated": 0,
            "id": 8544
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000424"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8545
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96503f76",
            "parentcaller": "0x7fff96584fd4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000424"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Elevation"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\Elevation"
              }
            ],
            "repeated": 0,
            "id": 8546
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9702adb1",
            "parentcaller": "0x7fff970283b8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000424"
              }
            ],
            "repeated": 0,
            "id": 8547
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff970222bf",
            "parentcaller": "0x7fff970225e9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}"
              }
            ],
            "repeated": 0,
            "id": 8548
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9709f8f8",
            "parentcaller": "0x7fff9702213b",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000418"
              },
              {
                "name": "SubKey",
                "value": "TreatAs"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\TreatAs"
              }
            ],
            "repeated": 0,
            "id": 8549
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8550
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff964f30ce",
            "parentcaller": "0x7fff970a2cd1",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8551
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\usoapi"
              },
              {
                "name": "DllBase",
                "value": "0x7fff3a110000"
              }
            ],
            "repeated": 0,
            "id": 8552
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\usoapi.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff3a110000"
              }
            ],
            "repeated": 0,
            "id": 8553
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff965056b2",
            "parentcaller": "0x7fff97046b6d",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff3a110000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\usoapi.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 8554
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046acf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usoapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff3a110000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff3a111630"
              }
            ],
            "repeated": 0,
            "id": 8555
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046ae8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": false,
            "return": "0xffffffffc0000139",
            "pretty_return": "ENTRYPOINT_NOT_FOUND",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usoapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff3a110000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x00000000"
              }
            ],
            "repeated": 0,
            "id": 8556
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9650ac31",
            "parentcaller": "0x7fff97046b08",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "usoapi.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff3a110000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff3a1117a0"
              }
            ],
            "repeated": 0,
            "id": 8557
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98c93f7a",
            "parentcaller": "0x7fff96cc0ed7",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8558
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff96cc0cd1",
            "parentcaller": "0x7fff96cbf28f",
            "category": "filesystem",
            "api": "NtOpenDirectoryObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "DirectoryHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020001",
                "pretty_value": "FILE_READ_ACCESS|READ_CONTROL"
              },
              {
                "name": "ObjectAttributes",
                "value": "C:\\RPC Control"
              }
            ],
            "repeated": 0,
            "id": 8559
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff9654026b",
            "parentcaller": "0x7fff96cc0daf",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000414"
              }
            ],
            "repeated": 0,
            "id": 8560
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98cc9c4e",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8561
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "(2\\x06\\xed\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00t\\x00%\\x00\\\\x00S\\x00y\\x00s\\x00t\\x00e\\x00m\\x003\\x002\\x00\\\\x00F\\x00l\\x00i\\x00g\\x00h\\x00t\\x00S\\x00e\\x00t\\x00t\\x00i\\x00n\\x00g\\x00s\\x00.\\x00d\\x00"
              }
            ],
            "repeated": 0,
            "id": 8562
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "p4\\x06\\xed\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00 \\x00a\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00h\\x00o\\x00u\\x00r\\x00s\\x00 \\x00r\\x00e\\x00q\\x00u\\x00i\\x00r\\x00e\\x00m\\x00e\\x00n\\x00t\\x00 \\x00m\\x00e\\x00t\\x00\\x00\\x00c\\x00y\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8563
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8564
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa8\\xe8\\x9a\\xef\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8565
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8566
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x98\\x0f\\x03\\xed\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8567
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00\\xc8\\xd7#\\x98\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\xb0\\xc3O\\xa4?\\x00\\x00\\x00\\xa8\\xc3O\\xa4?\\x00\\x00\\x00x\\xc3O\\xa4?\\x00\\x00\\x00\\x98\\xc3O\\xa4"
              }
            ],
            "repeated": 0,
            "id": 8568
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\x0f\\x03\\xed\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x98\\xc1O\\xa4?\\x00\\x00\\x00\\x14\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 8569
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98c88cde",
            "parentcaller": "0x7fff98c8953a",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "10"
              },
              {
                "name": "TokenInformation",
                "value": "[\\xa6\\x0b\\x00\\x00\\x00\\x00\\x00\\xe7\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x90\\xebL\\xb6&u \\x06\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x00\\x90\\x0f\\x00\\x00\\x0b\\x00\\x00\\x00\\x13\\x00\\x00\\x00V\\xa3\\x0b\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8570
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e46",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "4"
              },
              {
                "name": "TokenInformation",
                "value": "\\xc84\\x06\\xed\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8571
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6e9b",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\x90D\\x06\\xed\\x8c\\x01\\x00\\x00`\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8572
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6ec0",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8573
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f0e",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "5"
              },
              {
                "name": "TokenInformation",
                "value": "H\\xe4\\x9a\\xef\\x8c\\x01\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8574
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f37",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": false,
            "return": "0xffffffffc0000023",
            "pretty_return": "BUFFER_TOO_SMALL",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8575
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb6f8f",
            "parentcaller": "0x7fff98c88d8f",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "6"
              },
              {
                "name": "TokenInformation",
                "value": "\\x18\\x04\\x03\\xed\\x8c\\x01\\x00\\x00\\x02\\x00d\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x00\\x10\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x03\\x04\\x00\\x00\\x00\\x00\\x00(\\x00\\x00\\x00\\x00\\x10\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8576
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb7048",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00X@\\x19S\\xff\\x7f\\x00\\x00\\xebP\\xf1R\\xff\\x7f\\x00\\x00h\\xdb#\\x98\\x88(\\x00\\x00(N\\x15S\\xff\\x7f\\x00\\x00\\x10\\xc0O\\xa4?\\x00\\x00\\x00\\x08\\xc0O\\xa4?\\x00\\x00\\x00\\xd8\\xbfO\\xa4?\\x00\\x00\\x00\\xf8\\xbfO\\xa4"
              }
            ],
            "repeated": 0,
            "id": 8577
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12624",
            "caller": "0x7fff98cb707b",
            "parentcaller": "0x7fff98cb6fa8",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "41"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x10\\x04\\x03\\xed\\x8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd9\\xd8\\xf2R\\xff\\x7f\\x00\\x00#\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\xf8\\xbdO\\xa4?\\x00\\x00\\x00\\x14\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x9a\\x00\\xe7X\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x86\\xa2\\x15S"
              }
            ],
            "repeated": 0,
            "id": 8578
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845da4",
            "parentcaller": "0x7ff6d4845a54",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\FlightSettings.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80eb0000"
              }
            ],
            "repeated": 0,
            "id": 8579
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845da4",
            "parentcaller": "0x7ff6d4845a54",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "3185A766-B338-11E4-A71E-12E3F512A338"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "E833FEB2-C58A-45E4-8D93-08874744FEBB"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8580
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8581
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8582
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsSelfhost\\ClientState"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfhost\\ClientState"
              }
            ],
            "repeated": 0,
            "id": 8583
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": "PilotInfoRing"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\PilotInfoRing"
              }
            ],
            "repeated": 0,
            "id": 8584
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 8585
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8586
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8587
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsSelfhost\\ClientState"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfhost\\ClientState"
              }
            ],
            "repeated": 0,
            "id": 8588
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": "ErrorState"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\ErrorState"
              }
            ],
            "repeated": 0,
            "id": 8589
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 8590
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8591
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8592
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000041c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\Setup"
              }
            ],
            "repeated": 0,
            "id": 8593
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              },
              {
                "name": "ValueName",
                "value": "SystemSetupInProgress"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 8594
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000041c"
              }
            ],
            "repeated": 0,
            "id": 8595
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80f92000"
              },
              {
                "name": "ModuleName",
                "value": "FlightSettings.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8596
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80f92000"
              },
              {
                "name": "ModuleName",
                "value": "FlightSettings.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8597
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80f92000"
              },
              {
                "name": "ModuleName",
                "value": "FlightSettings.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8598
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80f92000"
              },
              {
                "name": "ModuleName",
                "value": "FlightSettings.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8599
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000420"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\REGISTRY\\MACHINE\\Software\\Microsoft\\WindowsRuntime"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime"
              }
            ],
            "repeated": 0,
            "id": 8600
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000424"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000420"
              },
              {
                "name": "ObjectAttributesName",
                "value": "ActivatableClassId"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId"
              }
            ],
            "repeated": 0,
            "id": 8601
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000428"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000424"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Networking.Connectivity.NetworkInformation"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation"
              }
            ],
            "repeated": 0,
            "id": 8602
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000428"
              },
              {
                "name": "KeyInformation",
                "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00N\\x00e\\x00t\\x00w\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00.\\x00C\\x00o\\x00n\\x00n\\x00e\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00.\\x00N\\x00e\\x00t\\x00w\\x00o\\x00r\\x00k\\x00I\\x00n\\x00f\\x00o\\x00r\\x00m\\x00a\\x00t\\x00i\\x00o\\x00n\\x00\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xff8c\\x01\\x00\\x008\\xff8a\\x1b\\xff98\\xff88(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\x0bY\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff87\\x00\\x0bY\\xffff\\x7f\\x00\\x00h\\xffeaw\\xffa4?\\x00\\x00\\x00\\xffc8\\xff88\\x1b\\xff98\\xff88(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0\"\\x08\\xffed\\xff8c\\x01\\x00\\x00 \\xffbc\\xfff5\\xff80\\xffff\\x7f\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x19\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\xff90\\xfffc\\xff94\\xffef\\xff8c\\x01\\x00\\x00\\xffb0\\xffeaw\\xffa4?\\x00\\x00\\x00\\xffe4I\\xfff3R\\xffff\\x7f\\x00\\x00 \\xffbc\\xfff5\\xff80\\xffff\\x7f\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff \\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xffb9\\x00\\x0bY\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff9d\\xffd0\\x15S\\xffff\\x7f\\x00\\x00\\xffb8\\xffcf\\x15S\\xffff\\x7f\\x00\\x00\\xff90\\xfffc\\xff94\\xffef\\xff8c\\x01\\x00\\x00\\xfff8\\xff81\\x15S\\xffff\\x7f\\x00\\x00\\x19\\x01\\x02\\x00\\xff8c\\x01\\x00\\x00h\\xffd0\\x15S\\xffff\\x7f\\x00\\x00 \\x04\\x00\\x00\\x00\\x00\\x00\\x00P\\xffd0\\x15S\\xffff\\x7f\\x00\\x00\\xffa0\\xffeaw\\xffa4?\\x00\\x00\\x00\\xff98\\xff85\\x15S\\xffff\\x7f\\x00\\x00\\xffb0\\xffeaw\\xffa4?\\x00\\x00\\x00p\\xfff3\\xff94\\xffef\\xff8c\\x01\\x00\\x00\\xffb0t\\x04\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x01\\x00\\x000\\xffecw\\xffa4?\\x00\\x00\\x00\\xff90\\xfffc\\xff94\\xffef\\xff8c\\x01\\x00\\x00\\xffb0\"\\x08\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00$\\x00&\\x00\\x00\\x00\\x00\\x00\\xff8c\\xfff3\\xff94\\xffef\\xff8c\\x01\\x00\\x000\\x00\\x00\\x00\\xff8c\\x01\\x00\\x00 \\x04\\x00\\x00\\x00\\x00\\x00\\x00\\xffa0\\xffeaw\\xffa4?\\x00\\x00\\x00@\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xfffc\\xff94\\xffef\\xff8c\\x01\\x00\\x00\\x19h\\x04\\xff97\\xffff\\x7f\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8603
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 8604
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Server"
              }
            ],
            "repeated": 0,
            "id": 8605
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 8606
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Threading"
              }
            ],
            "repeated": 0,
            "id": 8607
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 8608
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000428"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 8609
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 8610
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 8611
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 8612
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 8613
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 8614
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 8615
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis"
              }
            ],
            "repeated": 0,
            "id": 8616
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000428"
              }
            ],
            "repeated": 0,
            "id": 8617
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity"
              },
              {
                "name": "DllBase",
                "value": "0x7fff82b00000"
              }
            ],
            "repeated": 0,
            "id": 8618
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82b00000"
              }
            ],
            "repeated": 0,
            "id": 8619
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff82b00000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 8620
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.Networking.Connectivity.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82b00000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82b03890"
              }
            ],
            "repeated": 0,
            "id": 8621
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.Networking.Connectivity.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82b00000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82b03980"
              }
            ],
            "repeated": 0,
            "id": 8622
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "Windows.Networking.Connectivity.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff82b00000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff82b03370"
              }
            ],
            "repeated": 0,
            "id": 8623
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000424"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Networking.Connectivity.NetworkInformationPrivate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate"
              }
            ],
            "repeated": 0,
            "id": 8624
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000430"
              },
              {
                "name": "KeyInformation",
                "value": "7_\\xffea\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00r\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00N\\x00e\\x00t\\x00w\\x00o\\x00r\\x00k\\x00i\\x00n\\x00g\\x00.\\x00C\\x00o\\x00n\\x00n\\x00e\\x00c\\x00t\\x00i\\x00v\\x00i\\x00t\\x00y\\x00.\\x00N\\x00e\\x00t\\x00w\\x00o\\x00r\\x00k\\x00I\\x00n\\x00f\\x00o\\x00r\\x00m\\x00a\\x00t\\x00i\\x00o\\x00n\\x00P\\x00r\\x00i\\x00v\\x00a\\x00t\\x00e\\x00\\xffd6\\xffea\\xff8c\\x01\\x00\\x00\\xff89\\xffe8w\\xffa4?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x1b\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\xffc4\\x02\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x01\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00x1\\x08\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00`\\xffe9w\\xffa4?\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x01\\x00\\x00\\x00\\xffe2\\x0e\\xffed\\xff8c\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P1\\x08\\xffed\\xff8c\\x01\\x00\\x00\\x00\\xffe2\\x0e\\xffed\\xff8c\\x01\\x00\\x00\\xffc0UZ\\xffef\\xff8c\\x01\\x00\\x00\\xffc7\\xffb3\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x10\\x1a\\x03\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffc0UZ\\xffef\\xff8c\\x01\\x00\\x00\\xffe0\\xffe2\\x03\\xffed\\xff8c\\x01\\x00\\x00\\xffe0\\xffe2\\x03\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffe2\\x0e\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x01\\x00\\x006\\xff8c\\x0e\\xff97\\xffff\\x7f\\x00\\x000\\xfff2\\xff94\\xffef\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffeaw\\xffa4?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\xffeaw\\xffa4?\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8625
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 8626
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Server"
              }
            ],
            "repeated": 0,
            "id": 8627
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 8628
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Threading"
              }
            ],
            "repeated": 0,
            "id": 8629
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 8630
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000430"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 8631
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 8632
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 8633
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 8634
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 8635
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x000000ea",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Type",
                "value": "0x3f00000003"
              },
              {
                "name": "DataLength",
                "value": "332"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 8636
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "Data",
                "value": "\\x01\\x00\\x14\\x804\\x01\\x00\\x00@\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\x04\\x01\t\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 8637
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 8638
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 8639
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtOpenProcessToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000008"
              },
              {
                "name": "TokenHandle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 8640
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "25"
              },
              {
                "name": "TokenInformation",
                "value": "\\xa0\\xecw\\xa4?\\x00\\x00\\x00`\\x00\\x00\\x00\\xff\\x7f\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00@\\x00\\x00\\xff\\xff\\xff\\xff\\xf8\\x81\\x15S\\xff\\x7f\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\xc0\\x15S\\xff\\x7f\\x00\\x00x\\xedw\\xa4?\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00k\\x02T\\x96\\xff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8641
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8642
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8643
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000430"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "System\\Setup"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\Setup"
              }
            ],
            "repeated": 0,
            "id": 8644
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              },
              {
                "name": "ValueName",
                "value": "SystemSetupInProgress"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress"
              }
            ],
            "repeated": 0,
            "id": 8645
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000430"
              }
            ],
            "repeated": 0,
            "id": 8646
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "CreateTimerQueueTimer",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "phNewTimer",
                "value": "0x18ced03dd30"
              },
              {
                "name": "TimerQueue",
                "value": "0x00000000"
              },
              {
                "name": "Callback",
                "value": "0x82b42c00"
              },
              {
                "name": "Parameter",
                "value": "0xa477ef10"
              },
              {
                "name": "DueTime",
                "value": "10000"
              },
              {
                "name": "Period",
                "value": "1000"
              },
              {
                "name": "Flags",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8647
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8648
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\npmproxy"
              },
              {
                "name": "DllBase",
                "value": "0x7fff8e350000"
              }
            ],
            "repeated": 0,
            "id": 8649
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\npmproxy.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff8e350000"
              }
            ],
            "repeated": 0,
            "id": 8650
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "A47979D2-C419-11D9-A5B4-001185AD2B89"
              },
              {
                "name": "ClsContext",
                "value": "0x00000017",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_LOCAL_SERVER|CLSCTX_REMOTE_SERVER"
              },
              {
                "name": "riid",
                "value": "D0074FFD-570F-4A9B-8D69-199FDBA5723B"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 8651
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8652
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8653
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}"
              }
            ],
            "repeated": 0,
            "id": 8654
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000418"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000440"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8655
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8656
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 8657
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8658
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8659
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8660
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}"
              },
              {
                "name": "Handle",
                "value": "0x00000444"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}"
              }
            ],
            "repeated": 0,
            "id": 8661
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000444"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8662
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8663
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 8664
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000444"
              }
            ],
            "repeated": 0,
            "id": 8665
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8666
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8667
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}"
              }
            ],
            "repeated": 0,
            "id": 8668
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000418"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000440"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8669
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8670
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000440"
              }
            ],
            "repeated": 0,
            "id": 8671
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8672
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8673
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8674
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}"
              },
              {
                "name": "Handle",
                "value": "0x00000444"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}"
              }
            ],
            "repeated": 0,
            "id": 8675
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000444"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8676
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8677
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 8678
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000444"
              }
            ],
            "repeated": 0,
            "id": 8679
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8680
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8681
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}"
              }
            ],
            "repeated": 0,
            "id": 8682
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000448"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8683
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8684
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 8685
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 8686
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8687
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8688
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}"
              },
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}"
              }
            ],
            "repeated": 0,
            "id": 8689
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000448"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 8690
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 8691
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 8692
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 8693
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 8694
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8695
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020119",
                "pretty_value": "KEY_QUERY_VALUE|KEY_ENUMERATE_SUB_KEYS|KEY_NOTIFY|KEY_WOW64_64KEY|STANDARD_RIGHTS_REQUIRED"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000424"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Windows.Foundation.PropertyValue"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue"
              }
            ],
            "repeated": 0,
            "id": 8696
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000448"
              },
              {
                "name": "KeyInformation",
                "value": "\\xff97\\xfffc\\xffe7\\xffe6\\xfff8\\xffee\\xffdc\\x01\\x00\\x00\\x00\\x00@\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00.\\x00F\\x00o\\x00u\\x00n\\x00d\\x00a\\x00t\\x00i\\x00o\\x00n\\x00.\\x00P\\x00r\\x00o\\x00p\\x00e\\x00r\\x00t\\x00y\\x00V\\x00a\\x00l\\x00u\\x00e\\x00?\\x00\\x1f\\x00\\x00\\x00\\x00\\x00k\\xffb8\\xffc7\\xff98\\xffff\\x7f\\x00\\x00>\\x00\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd0y\\x02\\xffed\\xff8c\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffd6\\xffea\\xff8c\\x01\\x00\\x00\\xffb9\\xffd7w\\xffa4?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x1b\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\xffc4\\x02\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x01\\x00\\x00\\xff90\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffc0\\x0c\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffb0E/\\xff97\\xffff\\x7f\\x00\\x00\\x18.\\x08\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff90\\xffd8w\\xffa4?\\x00\\x00\\x00\\xff87\\xff9d\\x03\\xff97\\xffff\\x7f\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x01\\x00\\x00 \\xfff6\\x03\\xffed\\xff8c\\x01\\x00\\x00\\xff80\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xfff0-\\x08\\xffed\\xff8c\\x01\\x00\\x00 \\xfff6\\x03\\xffed\\xff8c\\x01\\x00\\x00\\x00`Z\\xffef\\xff8c\\x01\\x00\\x00\\xffc7\\xffb3\\xffc7\\xff98\\xffff\\x7f\\x00\\x00\\x00\\x00\\xffce\\xffea\\xff8c\\x01\\x00\\x00\\xfff6s\\x03\\xff97\\xffff\\x7f\\x00\\x00Pr\\x04\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\xffff\\x00`Z\\xffef\\xff8c\\x01\\x00\\x00\\xffb0\\xfff5\\x03\\xffed\\xff8c\\x01\\x00\\x00\\xffb0\\xfff5\\x03\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xfff6\\x03\\xffed\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff8c\\x01\\x00\\x006\\xff8c\\x0e\\xff97\\xffff\\x7f\\x00\\x00`\\xfff9\\xff94\\xffef\\xff8c\\x01\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffd9w\\xffa4?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff80\\xffd9w\\xffa4?\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8697
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "ActivationType"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType"
              }
            ],
            "repeated": 0,
            "id": 8698
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "Server"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server"
              }
            ],
            "repeated": 0,
            "id": 8699
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "DllPath"
              },
              {
                "name": "Data",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath"
              }
            ],
            "repeated": 0,
            "id": 8700
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "Threading"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading"
              }
            ],
            "repeated": 0,
            "id": 8701
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "TrustLevel"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel"
              }
            ],
            "repeated": 0,
            "id": 8702
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x00000448"
              },
              {
                "name": "SubKey",
                "value": "CustomAttributes"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes"
              }
            ],
            "repeated": 0,
            "id": 8703
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "RemoteServer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer"
              }
            ],
            "repeated": 0,
            "id": 8704
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "ActivateAsUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser"
              }
            ],
            "repeated": 0,
            "id": 8705
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "ActivateInSharedBroker"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker"
              }
            ],
            "repeated": 0,
            "id": 8706
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "ActivateInBrokerForMediumILContainer"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer"
              }
            ],
            "repeated": 0,
            "id": 8707
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "Permissions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions"
              }
            ],
            "repeated": 0,
            "id": 8708
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              },
              {
                "name": "ValueName",
                "value": "ActivateOnHostFlags"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags"
              }
            ],
            "repeated": 0,
            "id": 8709
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000448"
              }
            ],
            "repeated": 0,
            "id": 8710
          },
          {
            "timestamp": "2026-05-28 22:32:58,512",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\WinTypes"
              },
              {
                "name": "DllBase",
                "value": "0x7fff92180000"
              }
            ],
            "repeated": 0,
            "id": 8711
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff92180000"
              }
            ],
            "repeated": 0,
            "id": 8712
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff92180000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "C:\\Windows\\System32\\WinTypes.dll"
              },
              {
                "name": "dwFlags",
                "value": "0x00002008"
              }
            ],
            "repeated": 0,
            "id": 8713
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "WinTypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff92180000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetClassObject"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff92189590"
              }
            ],
            "repeated": 0,
            "id": 8714
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "WinTypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff92180000"
              },
              {
                "name": "FunctionName",
                "value": "DllGetActivationFactory"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff921890f0"
              }
            ],
            "repeated": 0,
            "id": 8715
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "WinTypes.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff92180000"
              },
              {
                "name": "FunctionName",
                "value": "DllCanUnloadNow"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff921947b0"
              }
            ],
            "repeated": 0,
            "id": 8716
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82bb1000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Networking.Connectivity.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8717
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a7a",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff82bb1000"
              },
              {
                "name": "ModuleName",
                "value": "Windows.Networking.Connectivity.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8718
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8719
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8720
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsSelfhost\\Applicability"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfhost\\Applicability"
              }
            ],
            "repeated": 0,
            "id": 8721
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "IsBuildFlightingEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\IsBuildFlightingEnabled"
              }
            ],
            "repeated": 0,
            "id": 8722
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 8723
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8724
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8725
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000450"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsSelfhost\\OneSettings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfhost\\OneSettings"
              }
            ],
            "repeated": 0,
            "id": 8726
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "IsBuildUnsupported"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\OneSettings\\IsBuildUnsupported"
              }
            ],
            "repeated": 0,
            "id": 8727
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 8728
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8729
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8730
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 8731
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 8732
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 8733
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Policies\\Microsoft\\Windows\\PreviewBuilds"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PreviewBuilds"
              }
            ],
            "repeated": 0,
            "id": 8734
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80f92000"
              },
              {
                "name": "ModuleName",
                "value": "FlightSettings.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8735
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff80f92000"
              },
              {
                "name": "ModuleName",
                "value": "FlightSettings.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8736
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds"
              },
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds"
              }
            ],
            "repeated": 0,
            "id": 8737
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 8738
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 8739
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 8740
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 8741
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 8742
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 8743
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 8744
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 8745
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 8746
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\30Value"
              }
            ],
            "repeated": 0,
            "id": 8747
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8748
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff900be000"
              },
              {
                "name": "ModuleName",
                "value": "policymanager.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8749
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "Data",
                "value": "3"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Value"
              }
            ],
            "repeated": 0,
            "id": 8750
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 8751
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 8752
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview"
              },
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview"
              }
            ],
            "repeated": 0,
            "id": 8753
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "PolicyType"
              },
              {
                "name": "Data",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\PolicyType"
              }
            ],
            "repeated": 0,
            "id": 8754
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 8755
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "MergeAlgorithm"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\MergeAlgorithm"
              }
            ],
            "repeated": 0,
            "id": 8756
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirectMapped"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirectMapped"
              }
            ],
            "repeated": 0,
            "id": 8757
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "RegKeyPathRedirect"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirect"
              }
            ],
            "repeated": 0,
            "id": 8758
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "grouppolicyname"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\grouppolicyname"
              }
            ],
            "repeated": 0,
            "id": 8759
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataUser"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataUser"
              }
            ],
            "repeated": 0,
            "id": 8760
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataDevice"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataDevice"
              }
            ],
            "repeated": 0,
            "id": 8761
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "ADMXMetadataBoth"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataBoth"
              }
            ],
            "repeated": 0,
            "id": 8762
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "30Value"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\30Value"
              }
            ],
            "repeated": 0,
            "id": 8763
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "Value"
              },
              {
                "name": "Data",
                "value": "2"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Value"
              }
            ],
            "repeated": 0,
            "id": 8764
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 8765
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4845a9b",
            "parentcaller": "0x7ff6d4873183",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\System"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System"
              }
            ],
            "repeated": 0,
            "id": 8766
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8767
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8768
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8769
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8770
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8771
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f16ba",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8772
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 8773
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 8774
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000450"
              }
            ],
            "repeated": 0,
            "id": 8775
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8776
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8777
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x00\\xc0\\x0f\\x00\\x00 \\x13\\x00\\x00\\x00\\x00\\x00\\x00\"\\xc6e\\xef\\xf1\\xee\\xdc\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\xc0\\x0f\\x00\\x00 \\x00\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x008\\x00=\\xeb\\x8c\\x01\\x00\\x00J\\x02\\x13\\xc0\\x01\\x00\\x00\\x00P1\\x00\\x00`\\x1f\\x00\\x00K\\x85\\xf0\\xec\\xf1\\xee\\xdc\\x01\\xccg\\xddY\\xe1|\\xf8R\\xcft\\xfe\\x8a%z+k\\x00\\x00\\x00\\x0b\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf2\\x93\\xfbWq\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00P\\x00\\x0c\\x00\\x01\\x00B\\x00B\\x00Microsoft.Windows.Update.Orchestrator.Worker\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00\\x00\\x00\\x00\\xa8\\x00\\x0b\\x00\\x00\\x00\\x99\\x00\\x99\\x00\\x00UpdateLoadedF"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 8778
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 8779
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8780
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8781
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8782
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8783
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8784
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8785
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8786
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 8787
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 8788
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 8789
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4d72",
            "parentcaller": "0x7ff6d488dc41",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINDOWSUPDATE\\WINREUNINSTALLLIST"
              },
              {
                "name": "Handle",
                "value": "0x0000044c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINDOWSUPDATE\\WINREUNINSTALLLIST"
              }
            ],
            "repeated": 0,
            "id": 8790
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4e05",
            "parentcaller": "0x7ff6d488dc41",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000044c"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "0"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "1"
              },
              {
                "name": "MaxValueNameLength",
                "value": "9"
              },
              {
                "name": "MaxValueLength",
                "value": "42"
              }
            ],
            "repeated": 0,
            "id": 8791
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4fcd",
            "parentcaller": "0x7ff6d488dc41",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000044c"
              }
            ],
            "repeated": 0,
            "id": 8792
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtSetInformationProcess",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessInformationClass",
                "value": "93"
              },
              {
                "name": "ProcessInformation",
                "value": "\\x7f7\\x9e}"
              }
            ],
            "repeated": 0,
            "id": 8793
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtOpenSection",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d"
              },
              {
                "name": "ObjectAttributes",
                "value": "productenumerator.dll"
              }
            ],
            "repeated": 0,
            "id": 8794
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\productenumerator.dll"
              }
            ],
            "repeated": 0,
            "id": 8795
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "filesystem",
            "api": "NtOpenFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x0000044c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00100021",
                "pretty_value": "FILE_READ_ACCESS|FILE_EXECUTE|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\productenumerator.dll"
              },
              {
                "name": "ShareAccess",
                "value": "5",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_DELETE"
              }
            ],
            "repeated": 0,
            "id": 8796
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtCreateSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x0000000d",
                "pretty_value": "SECTION_QUERY|SECTION_MAP_READ|SECTION_MAP_EXECUTE"
              },
              {
                "name": "ObjectAttributes",
                "value": ""
              },
              {
                "name": "FileHandle",
                "value": "0x0000044c"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\ProductEnumerator.dll"
              }
            ],
            "repeated": 0,
            "id": 8797
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtMapViewOfSection",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SectionHandle",
                "value": "0x00000418"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d020000"
              },
              {
                "name": "SectionOffset",
                "value": "0x00000000"
              },
              {
                "name": "ViewSize",
                "value": "0x0000e000"
              },
              {
                "name": "Win32Protect",
                "value": "0x00000080",
                "pretty_value": "PAGE_EXECUTE_WRITECOPY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8798
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d027000"
              },
              {
                "name": "ModuleName",
                "value": "productenumerator.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8799
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d027000"
              },
              {
                "name": "ModuleName",
                "value": "productenumerator.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8800
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d027000"
              },
              {
                "name": "ModuleName",
                "value": "productenumerator.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8801
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d027000"
              },
              {
                "name": "ModuleName",
                "value": "productenumerator.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8802
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d027000"
              },
              {
                "name": "ModuleName",
                "value": "productenumerator.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8803
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d027000"
              },
              {
                "name": "ModuleName",
                "value": "productenumerator.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8804
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\SYSTEM32\\productenumerator"
              },
              {
                "name": "DllBase",
                "value": "0x7fff7d020000"
              }
            ],
            "repeated": 0,
            "id": 8805
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 8806
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventRegister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c92e80"
              }
            ],
            "repeated": 0,
            "id": 8807
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventUnregister"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0390"
              }
            ],
            "repeated": 0,
            "id": 8808
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventEnabled"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ca0d10"
              }
            ],
            "repeated": 0,
            "id": 8809
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "EtwEventWrite"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98c9f1b0"
              }
            ],
            "repeated": 0,
            "id": 8810
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "system",
            "api": "LdrpCallInitRoutine",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "MappedPath",
                "value": "\\Device\\HarddiskVolume2\\Windows\\System32\\ProductEnumerator"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff7d020000"
              },
              {
                "name": "InitRoutine",
                "value": "0x7fff7d025ad0"
              },
              {
                "name": "Reason",
                "value": "1"
              }
            ],
            "repeated": 0,
            "id": 8811
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8812
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d4863df2",
            "parentcaller": "0x7ff6d48d0f3f",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7ff6d4959000"
              },
              {
                "name": "ModuleName",
                "value": "mousocoreworker.exe"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 8813
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 8814
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8815
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 8816
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 8817
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 8818
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 8819
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 8820
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 8821
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 8822
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 8823
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 8824
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 8825
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 8826
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8827
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 8828
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8829
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8830
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 8831
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8832
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8833
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 8834
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8835
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8836
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 8837
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8838
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8839
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 8840
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8841
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8842
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 8843
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8844
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8845
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 8846
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8847
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8848
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 8849
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8850
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8851
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 8852
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8853
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8854
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 8855
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8856
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8857
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 8858
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8859
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8860
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 8861
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8862
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8863
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8864
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 8865
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8866
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8867
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 8868
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8869
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8870
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 8871
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8872
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8873
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 8874
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8875
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8876
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 8877
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8878
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8879
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 8880
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8881
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8882
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 8883
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8884
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8885
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 8886
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8887
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8888
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 8889
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8890
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 8891
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 8892
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 8893
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 8894
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 8895
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8896
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8897
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8898
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8899
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8900
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8901
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8902
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8903
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8904
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8905
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8906
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8907
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 8908
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8909
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 8910
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8911
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8912
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 8913
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8914
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8915
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 8916
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8917
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8918
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 8919
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8920
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8921
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 8922
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8923
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8924
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 8925
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8926
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8927
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8928
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8929
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8930
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8931
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8932
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8933
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8934
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8935
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8936
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8937
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8938
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8939
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8940
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8941
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8942
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8943
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8944
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8945
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8946
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8947
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8948
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8949
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8950
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8951
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8952
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8953
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8954
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8955
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8956
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8957
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8958
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8959
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8960
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8961
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8962
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8963
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8964
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8965
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8966
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8967
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8968
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8969
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8970
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8971
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8972
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8973
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8974
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8975
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8976
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8977
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8978
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8979
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8980
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8981
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8982
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8983
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8984
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8985
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8986
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8987
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8988
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8989
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8990
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8991
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8992
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8993
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8994
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 8995
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8996
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 8997
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 8998
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 8999
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 9000
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 9001
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale"
              }
            ],
            "repeated": 0,
            "id": 9002
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 9003
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00020019",
                "pretty_value": "KEY_READ"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale"
              }
            ],
            "repeated": 0,
            "id": 9004
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
              }
            ],
            "repeated": 0,
            "id": 9005
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "en-US"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US"
              }
            ],
            "repeated": 0,
            "id": 9006
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000368"
              },
              {
                "name": "ValueName",
                "value": "en"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en"
              }
            ],
            "repeated": 0,
            "id": 9007
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 9008
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9009
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9010
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9011
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 9012
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9013
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9014
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 9015
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9016
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9017
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 9018
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9019
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9020
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 9021
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9022
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9023
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 9024
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9025
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9026
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9027
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9028
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9029
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 9030
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9031
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9032
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 9033
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9034
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9035
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 9036
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9037
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9038
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 9039
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9040
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9041
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9042
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9043
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9044
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9045
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9046
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9047
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9048
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9049
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9050
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9051
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9052
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9053
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9054
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9055
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9056
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9057
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9058
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9059
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9060
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9061
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9062
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9063
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9064
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9065
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9066
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9067
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9068
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9069
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9070
          },
          {
            "timestamp": "2026-05-28 22:32:58,528",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9071
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9072
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9073
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9074
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9075
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 9076
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9077
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9078
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9079
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9080
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9081
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9082
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 9083
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9084
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9085
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9086
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9087
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9088
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9089
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9090
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9091
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9092
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9093
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9094
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9095
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9096
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9097
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\n\\x00\\x00\\x00\\x07\\x0cX\\x00\\x0e\\xf3\\x0el\\x0cX\rb\\x0c\\xdf\r\\xe5\\x0fz\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "8192"
              }
            ],
            "repeated": 0,
            "id": 9098
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9099
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9100
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9101
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9102
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9103
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9104
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9105
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9106
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 9107
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9108
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9109
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9110
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9111
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9112
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9113
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9114
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9115
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9116
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9117
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9118
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9119
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9120
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9121
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9122
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9123
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9124
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9125
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9126
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9127
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9128
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9129
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9130
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9131
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9132
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9133
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9134
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9135
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9136
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9137
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9138
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9139
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9140
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9141
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9142
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9143
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 9144
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9145
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9146
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9147
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9148
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9149
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9150
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9151
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9152
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9153
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9154
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9155
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9156
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9157
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9158
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9159
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9160
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9161
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9162
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9163
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9164
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9165
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9166
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9167
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9168
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9169
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9170
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9171
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9172
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9173
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9174
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9175
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9176
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9177
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9178
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9179
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9180
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9181
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9182
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9183
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9184
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9185
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9186
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9187
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9188
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9189
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9190
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9191
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9192
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9193
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9194
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9195
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9196
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9197
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9198
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9199
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9200
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9201
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9202
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9203
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9204
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9205
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9206
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9207
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9208
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9209
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9210
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9211
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9212
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9213
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9214
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9215
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9216
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9217
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9218
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9219
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9220
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9221
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9222
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9223
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9224
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9225
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9226
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9227
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9228
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9229
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9230
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9231
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9232
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9233
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9234
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9235
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9236
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9237
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9238
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9239
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9240
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9241
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9242
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9243
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9244
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9245
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9246
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9247
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9248
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9249
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9250
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9251
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9252
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9253
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9254
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9255
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9256
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9257
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9258
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9259
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9260
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9261
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9262
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9263
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9264
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9265
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9266
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9267
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9268
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9269
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9270
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9271
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9272
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9273
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9274
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9275
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9276
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9277
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9278
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9279
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9280
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9281
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9282
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 9283
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9284
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9285
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9286
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9287
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9288
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9289
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9290
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9291
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9292
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9293
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9294
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9295
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9296
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9297
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9298
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9299
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9300
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9301
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9302
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9303
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9304
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9305
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9306
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9307
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9308
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9309
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9310
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9311
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9312
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9313
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9314
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9315
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9316
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9317
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9318
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9319
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9320
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9321
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9322
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9323
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9324
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9325
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9326
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9327
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9328
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9329
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9330
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9331
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9332
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9333
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9334
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9335
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9336
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9337
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9338
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9339
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9340
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9341
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9342
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9343
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9344
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9345
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 9346
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "Y\\x9a>]\\xd5\\xe9\\x00K\\xa6\\xbd\\xff4\\xffQeH\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E\\x81\\xbc\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 9347
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "59"
              },
              {
                "name": "InputBuffer",
                "value": "Y\\x9a>]\\xd5\\xe9\\x00K\\xa6\\xbd\\xff4\\xffQeH"
              },
              {
                "name": "OutputBuffer",
                "value": "$\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00 \\xf03\\x96\\xff\\x7f\\x00\\x008\\xe3w\\xa4"
              }
            ],
            "repeated": 0,
            "id": 9348
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9349
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 9350
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9351
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 9352
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 9353
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 9354
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 9355
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 9356
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 9357
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 9358
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 9359
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 9360
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9361
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 9362
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 9363
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 9364
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9365
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 9366
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9367
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9368
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 9369
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9370
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9371
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 9372
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9373
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9374
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 9375
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9376
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9377
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 9378
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9379
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9380
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 9381
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9382
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9383
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 9384
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9385
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9386
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 9387
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9388
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9389
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 9390
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9391
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9392
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 9393
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9394
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9395
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 9396
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9397
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9398
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 9399
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9400
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9401
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9402
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 9403
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9404
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9405
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 9406
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9407
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9408
          },
          {
            "timestamp": "2026-05-28 22:32:58,543",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9409
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9410
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9411
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9412
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9413
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9414
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 9415
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9416
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9417
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 9418
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9419
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9420
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 9421
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9422
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9423
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 9424
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9425
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9426
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 9427
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9428
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 9429
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 9430
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 9431
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 9432
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9433
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9434
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9435
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9436
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9437
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9438
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9439
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9440
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9441
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9442
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9443
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9444
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9445
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 9446
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9447
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 9448
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9449
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9450
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 9451
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9452
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9453
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 9454
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9455
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9456
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 9457
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9458
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9459
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9460
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9461
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9462
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9463
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9464
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9465
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9466
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9467
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9468
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9469
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9470
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9471
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9472
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9473
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9474
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9475
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9476
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9477
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9478
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9479
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9480
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9481
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9482
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9483
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9484
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9485
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9486
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9487
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9488
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9489
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9490
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9491
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9492
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9493
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9494
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9495
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9496
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9497
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9498
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9499
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9500
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9501
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9502
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9503
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9504
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9505
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9506
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9507
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9508
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9509
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9510
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9511
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9512
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9513
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9514
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9515
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9516
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9517
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9518
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9519
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9520
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9521
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9522
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9523
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9524
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9525
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9526
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9527
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9528
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9529
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9530
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9531
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9532
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 9533
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9534
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9535
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 9536
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9537
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 9538
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 9539
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 9540
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9541
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9542
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9543
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 9544
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9545
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9546
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 9547
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9548
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9549
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 9550
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9551
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9552
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 9553
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9554
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9555
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 9556
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9557
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9558
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9559
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9560
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9561
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 9562
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9563
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9564
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 9565
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9566
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9567
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 9568
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9569
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9570
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 9571
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9572
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9573
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 9574
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9575
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9576
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9577
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9578
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9579
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9580
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9581
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9582
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9583
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9584
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9585
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9586
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9587
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9588
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9589
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9590
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9591
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9592
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9593
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9594
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9595
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9596
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9597
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 9598
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 9599
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9600
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9601
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9602
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9603
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9604
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9605
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9606
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9607
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 9608
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9609
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9610
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9611
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9612
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9613
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9614
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 9615
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9616
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9617
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9618
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9619
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9620
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9621
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9622
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9623
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9624
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9625
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 9626
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9627
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9628
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9629
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9630
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9631
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9632
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9633
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9634
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9635
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9636
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9637
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9638
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 9639
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9640
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9641
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9642
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9643
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9644
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9645
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9646
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9647
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9648
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9649
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9650
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9651
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9652
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9653
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9654
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9655
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9656
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9657
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9658
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9659
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9660
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9661
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9662
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9663
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9664
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9665
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9666
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9667
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9668
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9669
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9670
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9671
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9672
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9673
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9674
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9675
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 9676
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9677
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9678
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9679
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9680
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9681
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9682
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9683
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9684
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9685
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9686
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9687
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9688
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9689
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9690
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9691
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9692
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9693
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9694
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9695
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9696
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9697
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9698
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9699
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9700
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9701
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9702
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9703
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9704
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9705
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9706
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9707
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9708
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9709
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9710
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9711
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9712
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9713
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9714
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9715
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9716
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9717
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9718
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9719
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9720
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9721
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9722
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9723
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9724
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9725
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9726
          },
          {
            "timestamp": "2026-05-28 22:32:58,559",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9727
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9728
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9729
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9730
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9731
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9732
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9733
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9734
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9735
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9736
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9737
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9738
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9739
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9740
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9741
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9742
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9743
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9744
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9745
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9746
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9747
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9748
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9749
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9750
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9751
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9752
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9753
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9754
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9755
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9756
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9757
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9758
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9759
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9760
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 9761
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9762
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9763
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9764
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9765
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9766
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9767
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9768
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9769
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9770
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9771
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9772
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9773
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9774
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9775
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9776
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9777
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9778
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9779
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9780
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9781
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9782
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9783
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9784
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9785
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9786
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9787
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9788
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9789
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9790
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 9791
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9792
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9793
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9794
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9795
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9796
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9797
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9798
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9799
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9800
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9801
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9802
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9803
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9804
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9805
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9806
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9807
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9808
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9809
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9810
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9811
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9812
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9813
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9814
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 9815
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9816
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9817
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9818
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9819
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9820
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9821
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9822
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9823
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9824
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9825
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9826
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9827
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9828
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9829
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9830
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9831
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9832
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9833
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9834
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 9835
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9836
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9837
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9838
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9839
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9840
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9841
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9842
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9843
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9844
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9845
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9846
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9847
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9848
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9849
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9850
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9851
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9852
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9853
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 9854
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 9855
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9856
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9857
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9858
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9859
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9860
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9861
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9862
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9863
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9864
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9865
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9866
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9867
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9868
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9869
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9870
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9871
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9872
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9873
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9874
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 9875
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9876
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9877
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 9878
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9879
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 9880
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000454"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 9881
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9882
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9883
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9884
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9885
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 9886
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9887
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 9888
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9889
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9890
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9891
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9892
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9893
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9894
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9895
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "AUPowerManagement"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AUPowerManagement"
              }
            ],
            "repeated": 0,
            "id": 9896
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483fd85",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9897
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486ffb5",
            "parentcaller": "0x7ff6d486e770",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "4"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x01\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9898
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d47fda8b",
            "parentcaller": "0x7ff6d486f53a",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "44"
              }
            ],
            "repeated": 0,
            "id": 9899
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d47fda8b",
            "parentcaller": "0x7ff6d486f53a",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9900
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d47fda8b",
            "parentcaller": "0x7ff6d486f53a",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "RtlGetSystemTimeAndBias"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98cec6a0"
              }
            ],
            "repeated": 0,
            "id": 9901
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d486f5bd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 9902
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d486f5bd",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SmartSchedulerEndHour"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerEndHour"
              }
            ],
            "repeated": 0,
            "id": 9903
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d486f5bd",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9904
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9905
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9906
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9907
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9908
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9909
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9910
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9911
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9912
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9913
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9914
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 9915
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9916
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9917
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9918
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9919
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 9920
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483dab4",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9921
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d483dbbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9922
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d483dbbe",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 9923
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d483dbbe",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9924
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9925
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9926
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9927
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 9928
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9929
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9930
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9931
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9932
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "Data",
                "value": "17"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 9933
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9934
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d486f5bd",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 9935
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d486f5bd",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SmartSchedulerStartHour"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerStartHour"
              }
            ],
            "repeated": 0,
            "id": 9936
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d486f5bd",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9937
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 9938
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 9939
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 9940
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 9941
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9942
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9943
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 9944
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9945
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9946
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 9947
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 9948
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 9949
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9950
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 9951
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 9952
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 9953
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d724",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9954
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d483d82e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9955
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d483d82e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 9956
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d483d82e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9957
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9958
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9959
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9960
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 9961
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9962
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9963
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9964
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000418"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9965
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "Data",
                "value": "8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 9966
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9967
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d486e841",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 9968
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d486e841",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SmartSchedulerDelayInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDelayInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9969
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d486e841",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9970
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d486f22c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 9971
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d486f22c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SmartSchedulerDurationInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDurationInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9972
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d486f22c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9973
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d486f3d8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 9974
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d486f3d8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              },
              {
                "name": "ValueName",
                "value": "SmartSchedulerDelayInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDelayInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9975
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d486f3d8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000418"
              }
            ],
            "repeated": 0,
            "id": 9976
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d4864c97",
            "parentcaller": "0x7ff6d486fcef",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 9977
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "102"
              }
            ],
            "repeated": 0,
            "id": 9978
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "registry",
            "api": "NtOpenKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x82000000",
                "pretty_value": "0x82000000"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x00000000"
              },
              {
                "name": "ObjectAttributesName",
                "value": "\\Registry\\Machine\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST"
              }
            ],
            "repeated": 0,
            "id": 9979
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb640000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9980
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "FirstEntry"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "2006"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\FirstEntry"
              }
            ],
            "repeated": 0,
            "id": 9981
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "LastEntry"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Information",
                "value": "2007"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\LastEntry"
              }
            ],
            "repeated": 0,
            "id": 9982
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "2026"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2026"
              }
            ],
            "repeated": 0,
            "id": 9983
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb640000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 9984
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb640000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9985
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "registry",
            "api": "NtQueryValueKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "2007"
              },
              {
                "name": "Type",
                "value": "3",
                "pretty_value": "REG_BINARY"
              },
              {
                "name": "Information",
                "value": ",\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xc4\\xff\\xff\\xff\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2007"
              }
            ],
            "repeated": 0,
            "id": 9986
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb640000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 9987
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486f00c",
            "parentcaller": "0x7ff6d486ebb3",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "api-ms-win-security-systemfunctions-l1-1-0"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff983c0000"
              }
            ],
            "repeated": 0,
            "id": 9988
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486f00c",
            "parentcaller": "0x7ff6d486ebb3",
            "category": "system",
            "api": "LoadLibraryExW",
            "status": true,
            "return": "0x7fff983c0000",
            "arguments": [
              {
                "name": "lpLibFileName",
                "value": "api-ms-win-security-systemfunctions-l1-1-0"
              },
              {
                "name": "dwFlags",
                "value": "0x00000800"
              }
            ],
            "repeated": 0,
            "id": 9989
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486f00c",
            "parentcaller": "0x7ff6d486ebb3",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ADVAPI32.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff983c0000"
              },
              {
                "name": "FunctionName",
                "value": "SystemFunction036"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff95c11010"
              }
            ],
            "repeated": 0,
            "id": 9990
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486f00c",
            "parentcaller": "0x7ff6d486ebb3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95c19000"
              },
              {
                "name": "ModuleName",
                "value": "CRYPTBASE.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9991
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486f00c",
            "parentcaller": "0x7ff6d486ebb3",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff95c19000"
              },
              {
                "name": "ModuleName",
                "value": "CRYPTBASE.DLL"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9992
          },
          {
            "timestamp": "2026-05-28 22:32:58,575",
            "thread_id": "12928",
            "caller": "0x7ff6d486fe1f",
            "parentcaller": "0x7ff6d486f8ad",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "102"
              }
            ],
            "repeated": 0,
            "id": 9993
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 9994
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 9995
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 9996
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 9997
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 9998
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 9999
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10000
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10001
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10002
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10003
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10004
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10005
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10006
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10007
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10008
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10009
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10010
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10011
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10012
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10013
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 10014
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10015
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10016
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10017
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 10018
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10019
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10020
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 10021
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10022
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10023
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10024
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 10025
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10026
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10027
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10028
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10029
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 10030
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10031
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10032
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10033
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10034
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10035
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10036
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10037
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10038
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10039
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10040
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10041
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10042
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10043
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10044
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10045
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10046
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10047
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10048
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10049
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10050
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10051
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10052
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10053
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10054
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10055
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10056
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10057
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10058
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10059
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10060
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10061
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10062
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10063
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10064
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10065
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10066
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10067
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10068
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10069
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10070
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10071
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10072
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10073
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10074
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10075
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10076
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10077
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10078
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10079
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10080
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10081
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10082
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10083
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10084
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10085
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10086
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10087
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10088
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10089
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10090
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10091
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10092
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10093
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10094
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10095
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10096
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10097
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10098
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10099
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10100
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10101
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10102
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10103
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10104
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10105
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10106
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10107
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10108
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10109
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10110
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10111
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10112
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10113
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10114
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10115
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10116
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10117
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10118
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10119
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10120
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10121
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10122
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10123
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10124
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10125
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10126
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10127
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10128
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10129
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10130
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10131
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10132
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10133
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10134
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10135
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10136
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10137
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10138
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10139
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10140
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10141
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10142
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10143
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10144
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10145
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10146
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10147
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10148
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 10149
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 10150
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10151
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10152
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10153
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10154
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10155
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 10156
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10157
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10158
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10159
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10160
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 10161
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10162
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10163
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10164
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10165
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10166
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10167
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10168
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10169
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10170
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10171
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10172
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10173
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10174
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10175
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10176
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10177
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10178
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10179
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10180
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10181
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10182
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10183
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10184
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10185
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10186
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10187
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10188
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10189
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10190
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10191
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10192
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 10193
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10194
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10195
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 10196
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10197
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10198
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10199
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10200
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10201
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10202
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10203
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10204
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10205
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10206
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10207
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10208
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10209
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10210
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10211
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10212
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10213
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10214
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10215
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10216
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10217
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10218
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10219
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10220
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10221
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10222
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10223
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 10224
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10225
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 10226
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000045c"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 10227
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10228
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10229
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10230
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10231
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10232
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10233
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10234
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10235
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10236
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10237
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10238
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10239
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10240
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10241
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10242
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 10243
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10244
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10245
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10246
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10247
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10248
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10249
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10250
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10251
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10252
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10253
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10254
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10255
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10256
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10257
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10258
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10259
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10260
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10261
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10262
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10263
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10264
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10265
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10266
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10267
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10268
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10269
          },
          {
            "timestamp": "2026-05-28 22:32:58,590",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10270
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10271
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10272
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10273
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10274
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10275
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10276
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10277
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10278
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10279
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10280
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10281
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10282
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10283
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10284
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10285
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10286
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10287
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10288
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10289
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10290
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10291
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10292
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10293
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10294
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10295
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10296
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10297
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10298
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10299
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10300
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10301
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10302
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10303
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10304
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef6c1000"
              },
              {
                "name": "RegionSize",
                "value": "0x00003000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10305
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10306
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10307
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10308
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10309
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10310
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10311
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10312
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10313
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10314
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10315
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10316
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10317
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10318
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10319
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10320
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10321
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10322
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10323
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10324
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10325
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10326
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10327
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10328
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10329
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10330
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10331
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10332
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10333
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10334
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10335
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 10336
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 10337
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10338
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10339
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10340
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10341
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10342
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10343
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10344
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10345
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10346
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10347
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10348
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10349
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10350
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10351
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10352
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10353
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10354
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10355
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10356
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10357
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10358
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10359
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10360
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10361
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10362
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10363
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10364
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10365
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10366
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10367
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10368
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10369
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10370
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10371
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10372
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10373
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10374
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10375
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10376
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10377
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10378
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10379
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10380
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10381
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10382
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10383
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10384
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10385
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10386
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10387
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10388
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10389
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10390
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10391
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10392
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10393
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10394
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10395
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10396
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10397
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10398
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10399
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10400
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10401
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10402
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10403
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10404
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10405
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 10406
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10407
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10408
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10409
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10410
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10411
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10412
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 10413
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10414
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10415
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10416
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10417
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10418
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10419
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10420
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10421
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10422
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10423
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10424
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10425
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10426
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10427
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10428
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10429
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10430
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10431
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10432
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10433
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10434
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10435
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10436
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 10437
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10438
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10439
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10440
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10441
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10442
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10443
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10444
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 10445
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10446
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10447
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 10448
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10449
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10450
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10451
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10452
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10453
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10454
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10455
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10456
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10457
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10458
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10459
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10460
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10461
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10462
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10463
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10464
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10465
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10466
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10467
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10468
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10469
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10470
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10471
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10472
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10473
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 10474
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10475
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10476
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10477
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10478
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10479
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10480
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10481
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 10482
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10483
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10484
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 10485
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10486
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10487
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10488
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10489
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10490
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10491
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10492
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10493
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10494
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10495
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10496
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10497
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10498
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10499
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10500
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10501
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10502
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10503
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10504
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10505
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10506
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10507
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10508
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10509
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10510
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10511
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10512
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10513
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10514
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10515
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10516
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10517
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10518
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10519
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10520
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10521
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              }
            ],
            "repeated": 0,
            "id": 10522
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10523
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10524
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10525
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10526
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10527
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10528
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10529
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10530
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10531
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10532
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10533
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10534
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10535
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10536
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10537
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10538
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10539
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10540
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10541
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10542
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10543
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10544
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10545
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb391000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10546
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10547
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10548
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10549
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10550
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10551
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10552
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10553
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10554
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10555
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10556
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10557
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10558
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10559
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10560
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10561
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10562
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10563
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10564
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10565
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10566
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10567
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10568
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10569
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10570
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10571
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10572
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10573
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb4ea000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10574
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10575
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10576
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10577
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000045c"
              }
            ],
            "repeated": 0,
            "id": 10578
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10579
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10580
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10581
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10582
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10583
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10584
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10585
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10586
          },
          {
            "timestamp": "2026-05-28 22:32:58,606",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10587
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10588
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10589
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10590
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 10591
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10592
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10593
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10594
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10595
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10596
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10597
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10598
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 10599
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10600
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10601
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 10602
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10603
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10604
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10605
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 10606
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10607
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10608
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10609
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10610
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 10611
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10612
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10613
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10614
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 10615
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10616
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10617
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10618
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10619
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10620
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10621
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10622
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 10623
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10624
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10625
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 10626
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10627
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10628
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10629
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10630
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10631
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10632
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10633
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10634
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10635
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10636
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10637
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10638
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10639
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10640
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10641
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10642
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10643
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10644
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10645
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10646
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10647
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10648
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 10649
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10650
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10651
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10652
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10653
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10654
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10655
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10656
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10657
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10658
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10659
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10660
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10661
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10662
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 10663
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10664
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10665
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 10666
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10667
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10668
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10669
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 10670
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10671
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10672
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10673
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10674
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 10675
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10676
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10677
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 10678
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10679
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 10680
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 10681
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 10682
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 10683
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10684
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10685
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10686
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10687
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10688
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 10689
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10690
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10691
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10692
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10693
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 10694
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10695
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10696
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10697
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10698
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10699
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10700
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10701
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10702
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10703
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10704
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10705
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10706
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10707
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10708
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10709
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10710
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10711
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10712
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10713
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10714
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10715
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10716
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10717
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10718
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10719
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10720
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10721
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10722
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10723
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10724
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10725
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 10726
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10727
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10728
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 10729
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10730
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10731
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10732
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10733
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10734
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10735
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10736
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10737
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10738
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10739
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10740
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10741
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10742
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10743
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10744
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10745
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10746
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10747
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10748
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10749
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10750
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10751
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10752
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10753
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10754
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10755
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10756
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 10757
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10758
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 10759
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 10760
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10761
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10762
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10763
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10764
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10765
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10766
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10767
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10768
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10769
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10770
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10771
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10772
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10773
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10774
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10775
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 10776
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10777
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10778
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10779
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10780
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10781
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10782
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10783
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10784
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10785
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10786
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10787
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10788
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10789
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10790
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10791
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10792
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10793
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10794
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10795
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10796
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10797
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10798
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10799
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10800
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10801
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10802
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10803
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10804
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10805
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10806
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10807
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10808
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10809
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10810
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10811
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10812
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10813
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10814
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10815
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10816
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10817
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10818
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10819
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10820
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10821
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10822
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10823
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10824
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10825
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10826
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10827
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10828
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10829
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10830
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10831
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10832
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10833
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10834
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10835
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10836
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10837
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10838
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10839
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10840
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10841
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10842
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10843
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10844
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10845
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10846
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10847
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10848
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10849
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10850
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10851
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10852
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10853
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10854
          },
          {
            "timestamp": "2026-05-28 22:32:58,622",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10855
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10856
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10857
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10858
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10859
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10860
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10861
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10862
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 10863
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10864
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10865
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 10866
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10867
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 10868
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 10869
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 10870
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10871
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10872
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10873
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 10874
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10875
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10876
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 10877
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10878
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10879
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 10880
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10881
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10882
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 10883
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10884
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10885
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 10886
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10887
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10888
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10889
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10890
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10891
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 10892
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10893
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10894
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 10895
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10896
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10897
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 10898
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10899
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10900
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 10901
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10902
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10903
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 10904
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10905
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10906
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10907
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10908
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10909
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10910
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10911
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10912
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10913
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10914
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10915
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10916
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10917
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10918
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10919
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10920
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10921
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10922
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10923
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10924
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10925
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10926
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10927
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 10928
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 10929
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 10930
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10931
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10932
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10933
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10934
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10935
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10936
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10937
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 10938
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10939
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 10940
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10941
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10942
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10943
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 10944
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 10945
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10946
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10947
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10948
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10949
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10950
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 10951
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10952
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10953
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10954
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10955
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 10956
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 10957
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10958
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10959
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10960
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10961
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10962
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10963
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 10964
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 10965
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 10966
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 10967
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 10968
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 10969
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 10970
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10971
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10972
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10973
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10974
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 10975
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10976
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 10977
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10978
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10979
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 10980
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10981
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10982
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 10983
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10984
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 10985
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 10986
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 10987
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 10988
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 10989
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 10990
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 10991
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 10992
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 10993
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 10994
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10995
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10996
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 10997
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 10998
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 10999
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11000
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11001
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11002
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11003
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11004
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11005
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 11006
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11007
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11008
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11009
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11010
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11011
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11012
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11013
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11014
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11015
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11016
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11017
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11018
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11019
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11020
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11021
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11022
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11023
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11024
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11025
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11026
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11027
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11028
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11029
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11030
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11031
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11032
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11033
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11034
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11035
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11036
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11037
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11038
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11039
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11040
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11041
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11042
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11043
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11044
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11045
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11046
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11047
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11048
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11049
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11050
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11051
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11052
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11053
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11054
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11055
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11056
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11057
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11058
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11059
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11060
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11061
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11062
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11063
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11064
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11065
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11066
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11067
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11068
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11069
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11070
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11071
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11072
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11073
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11074
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11075
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11076
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11077
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11078
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11079
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11080
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11081
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11082
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11083
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11084
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11085
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11086
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11087
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11088
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11089
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11090
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11091
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11092
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11093
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11094
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11095
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11096
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11097
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11098
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11099
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11100
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11101
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11102
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11103
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11104
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11105
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11106
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11107
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11108
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11109
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11110
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11111
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11112
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11113
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11114
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11115
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11116
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11117
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11118
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11119
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11120
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11121
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11122
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11123
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11124
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11125
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11126
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11127
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11128
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11129
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11130
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11131
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11132
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11133
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11134
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11135
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11136
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11137
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11138
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11139
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11140
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11141
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11142
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11143
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11144
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 11145
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11146
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11147
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11148
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11149
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11150
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11151
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11152
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11153
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11154
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11155
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11156
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11157
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11158
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11159
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11160
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11161
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 11162
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11163
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11164
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11165
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11166
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11167
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11168
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11169
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11170
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11171
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11172
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11173
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11174
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11175
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11176
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11177
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11178
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11179
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11180
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11181
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11182
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11183
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11184
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11185
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11186
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11187
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11188
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11189
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11190
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11191
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11192
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11193
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11194
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11195
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11196
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11197
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11198
          },
          {
            "timestamp": "2026-05-28 22:32:58,637",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11199
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11200
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11201
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11202
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11203
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11204
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11205
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11206
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11207
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 11208
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11209
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 11210
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000460"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 11211
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11212
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11213
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11214
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11215
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11216
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11217
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11218
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11219
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11220
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11221
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11222
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000464"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11223
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11224
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11225
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11226
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11227
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11228
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11229
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11230
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11231
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11232
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11233
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11234
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11235
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11236
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11237
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11238
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11239
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11240
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11241
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11242
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11243
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11244
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11245
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11246
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11247
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11248
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11249
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11250
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11251
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11252
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11253
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11254
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11255
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11256
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11257
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11258
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11259
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11260
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11261
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11262
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11263
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11264
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11265
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11266
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11267
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11268
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11269
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11270
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11271
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11272
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11273
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11274
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11275
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11276
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11277
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11278
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11279
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11280
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11281
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11282
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11283
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11284
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11285
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11286
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11287
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11288
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11289
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11290
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11291
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11292
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11293
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11294
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11295
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11296
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11297
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11298
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11299
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11300
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11301
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11302
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11303
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11304
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11305
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11306
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11307
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11308
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11309
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11310
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11311
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11312
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11313
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11314
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11315
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11316
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11317
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11318
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11319
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11320
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11321
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11322
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11323
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11324
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11325
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11326
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11327
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11328
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11329
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11330
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11331
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11332
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11333
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11334
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x00X\\x0f\\x00\\x00\\x80\\x12\\x00\\x00\\x00\\x00\\x00\\x00^\\xf2x\\xef\\xf1\\xee\\xdc\\x01\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00X\\x0f\\x00\\x00 \\x00\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x008\\x00=\\xeb\\x8c\\x01\\x00\\x00\\x1c\\x01\\x13\\xc0\\x01\\x00\\x00\\x00\\x802\\x00\\x00`\\x1f\\x00\\x00\\xdd%o\\xef\\xf1\\xee\\xdc\\x01'\\xbc\\x04%\\x8b\\x0e\\xed_z\\x9f\\xd8ir\\x08b\\x85\\x00\\x00\\x00\\x0b\\x05\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\xdb\\x13\\xa9\\xeft\\x00\\x00\\x00\rm\n\\x80\\xf1\\xee\\x00\\x00\\x81r\n\\x80\\xf1\\xee\\xdc\\x01P\\x00\\x0c\\x00\\x01\\x00E\\x00E\\x00Microsoft.Windows.Update.Orchestrator.Decisions\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00H\\x00\\x0b\\x00\\x00\\x00>\\x00>\\x00\\x00Decision\\x00Part"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 11335
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11336
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11337
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11338
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11339
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11340
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11341
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11342
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11343
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11344
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11345
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11346
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11347
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11348
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11349
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11350
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11351
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11352
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11353
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11354
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11355
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11356
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11357
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11358
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11359
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11360
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11361
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11362
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11363
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11364
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11365
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 11366
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 11367
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 11368
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 11369
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 11370
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 11371
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 11372
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 11373
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 11374
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11375
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 11376
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 11377
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 11378
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11379
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 11380
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11381
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11382
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 11383
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11384
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11385
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 11386
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11387
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11388
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 11389
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11390
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11391
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 11392
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11393
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11394
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 11395
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11396
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11397
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 11398
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11399
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11400
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 11401
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11402
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11403
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 11404
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11405
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11406
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 11407
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11408
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11409
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 11410
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11411
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11412
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 11413
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11414
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11415
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11416
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 11417
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11418
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11419
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 11420
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11421
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11422
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11423
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11424
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11425
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11426
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11427
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11428
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 11429
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11430
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11431
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 11432
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11433
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11434
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 11435
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11436
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11437
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 11438
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11439
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11440
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 11441
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11442
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 11443
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 11444
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 11445
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 11446
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11447
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11448
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11449
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11450
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11451
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11452
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11453
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11454
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11455
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11456
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11457
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11458
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11459
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 11460
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11461
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 11462
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11463
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11464
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 11465
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11466
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11467
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 11468
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11469
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11470
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 11471
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11472
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11473
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11474
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11475
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11476
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11477
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11478
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11479
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11480
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11481
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11482
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11483
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11484
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11485
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11486
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11487
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11488
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11489
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11490
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11491
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11492
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11493
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11494
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11495
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11496
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11497
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11498
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11499
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11500
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11501
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11502
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11503
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11504
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11505
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11506
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11507
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11508
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11509
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11510
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11511
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11512
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11513
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11514
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11515
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11516
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11517
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11518
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11519
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11520
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11521
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11522
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11523
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11524
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11525
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11526
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11527
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11528
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11529
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11530
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11531
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11532
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11533
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11534
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11535
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11536
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11537
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11538
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11539
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11540
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11541
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11542
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11543
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11544
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11545
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11546
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11547
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11548
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11549
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11550
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11551
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 11552
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 11553
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 11554
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11555
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11556
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11557
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 11558
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11559
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11560
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 11561
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11562
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11563
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 11564
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11565
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11566
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 11567
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11568
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11569
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 11570
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11571
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11572
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11573
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11574
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11575
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 11576
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11577
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11578
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 11579
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11580
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11581
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 11582
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11583
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11584
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 11585
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11586
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11587
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11588
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11589
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11590
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11591
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11592
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11593
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11594
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11595
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11596
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11597
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11598
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11599
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11600
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11601
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11602
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11603
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11604
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11605
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11606
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11607
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11608
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11609
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11610
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11611
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11612
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 11613
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11614
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11615
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11616
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11617
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11618
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11619
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11620
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11621
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 11622
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11623
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11624
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11625
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 11626
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 11627
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11628
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 11629
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11630
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11631
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11632
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 11633
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 11634
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11635
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11636
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11637
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11638
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 11639
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 11640
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 11641
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11642
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11643
          },
          {
            "timestamp": "2026-05-28 22:32:58,653",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11644
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11645
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11646
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11647
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11648
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11649
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11650
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11651
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11652
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 11653
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11654
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11655
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11656
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11657
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11658
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11659
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11660
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11661
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11662
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11663
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11664
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11665
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11666
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11667
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11668
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11669
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11670
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11671
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11672
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11673
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11674
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11675
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11676
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11677
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11678
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11679
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11680
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11681
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11682
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11683
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11684
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11685
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11686
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11687
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11688
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11689
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 11690
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11691
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11692
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11693
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11694
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11695
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11696
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11697
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11698
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11699
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11700
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11701
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11702
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11703
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11704
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11705
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11706
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11707
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11708
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11709
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11710
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11711
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11712
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11713
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11714
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11715
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11716
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11717
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11718
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11719
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11720
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11721
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11722
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11723
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11724
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11725
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11726
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11727
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11728
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11729
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11730
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11731
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11732
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11733
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11734
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11735
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11736
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11737
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000464"
              }
            ],
            "repeated": 0,
            "id": 11738
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11739
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11740
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11741
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11742
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11743
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11744
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11745
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11746
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11747
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11748
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11749
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11750
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11751
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11752
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11753
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11754
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11755
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11756
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11757
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11758
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11759
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11760
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11761
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11762
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11763
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11764
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11765
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11766
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11767
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11768
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11769
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11770
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11771
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11772
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11773
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11774
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 11775
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11776
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11777
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11778
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11779
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11780
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11781
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11782
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11783
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11784
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11785
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11786
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11787
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11788
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11789
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11790
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11791
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11792
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11793
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11794
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11795
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11796
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11797
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11798
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11799
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11800
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11801
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11802
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11803
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11804
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 11805
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11806
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11807
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11808
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11809
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11810
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11811
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11812
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11813
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11814
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11815
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11816
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11817
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11818
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11819
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11820
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11821
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11822
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11823
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11824
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11825
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11826
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11827
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11828
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 11829
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11830
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11831
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11832
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11833
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11834
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11835
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11836
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11837
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11838
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11839
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11840
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11841
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11842
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11843
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11844
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11845
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11846
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11847
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11848
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 11849
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11850
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 11851
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11852
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11853
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11854
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11855
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11856
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11857
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11858
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11859
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11860
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11861
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 11862
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 11863
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11864
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11865
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11866
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11867
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 11868
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 11869
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11870
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11871
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 11872
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 11873
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 11874
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11875
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 11876
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 11877
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11878
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11879
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 11880
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 11881
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 11882
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 11883
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11884
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 11885
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11886
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 11887
          },
          {
            "timestamp": "2026-05-28 22:32:58,668",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 11888
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 11889
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11890
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 11891
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 11892
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 11893
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 11894
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 11895
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 11896
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 11897
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 11898
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 11899
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 11900
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 11901
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 11902
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 11903
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 11904
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11905
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 11906
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 11907
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 11908
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11909
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 11910
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11911
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11912
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 11913
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11914
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11915
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 11916
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11917
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11918
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 11919
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11920
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11921
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 11922
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11923
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11924
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 11925
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11926
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11927
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 11928
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11929
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11930
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 11931
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11932
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11933
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 11934
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11935
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11936
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 11937
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11938
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11939
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 11940
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11941
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11942
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 11943
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11944
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11945
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11946
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 11947
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11948
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11949
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 11950
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11951
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11952
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11953
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11954
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11955
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11956
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11957
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11958
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 11959
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11960
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11961
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 11962
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11963
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11964
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 11965
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11966
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11967
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 11968
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11969
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 11970
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 11971
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 11972
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 11973
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000470"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 11974
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 11975
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 11976
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 11977
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11978
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11979
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11980
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11981
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11982
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11983
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11984
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11985
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11986
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11987
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11988
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 11989
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 11990
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 11991
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 11992
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11993
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 11994
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 11995
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 11996
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 11997
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 11998
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 11999
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12000
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 12001
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12002
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12003
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 12004
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12005
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12006
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 12007
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12008
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12009
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12010
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12011
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12012
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12013
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12014
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12015
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12016
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12017
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12018
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12019
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12020
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12021
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12022
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12023
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12024
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12025
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12026
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12027
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12028
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12029
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12030
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12031
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12032
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12033
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12034
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12035
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12036
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12037
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12038
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12039
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12040
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12041
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12042
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12043
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12044
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12045
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12046
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12047
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12048
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12049
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12050
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12051
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12052
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12053
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12054
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12055
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12056
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12057
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12058
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12059
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12060
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12061
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12062
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12063
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12064
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12065
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12066
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12067
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12068
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12069
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12070
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12071
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12072
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12073
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12074
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12075
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12076
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 12077
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12078
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12079
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 12080
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12081
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 12082
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 12083
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 12084
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12085
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12086
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12087
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 12088
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12089
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12090
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 12091
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12092
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12093
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 12094
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12095
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12096
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 12097
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12098
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12099
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 12100
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12101
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12102
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 12103
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12104
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12105
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 12106
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12107
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12108
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 12109
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12110
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12111
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 12112
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12113
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12114
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 12115
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12116
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12117
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 12118
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12119
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12120
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12121
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12122
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12123
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12124
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12125
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12126
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12127
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12128
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12129
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12130
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12131
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12132
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12133
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12134
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12135
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12136
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12137
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12138
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12139
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12140
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12141
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 12142
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 12143
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12144
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12145
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12146
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12147
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12148
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12149
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12150
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12151
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 12152
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12153
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12154
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12155
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12156
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12157
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12158
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 12159
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12160
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12161
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12162
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12163
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12164
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12165
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12166
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12167
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12168
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12169
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12170
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12171
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12172
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12173
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12174
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12175
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12176
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12177
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12178
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12179
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12180
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12181
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12182
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12183
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12184
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12185
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12186
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12187
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12188
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12189
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12190
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12191
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12192
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12193
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12194
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12195
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12196
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12197
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12198
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12199
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12200
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12201
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12202
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12203
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12204
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12205
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12206
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12207
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12208
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12209
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12210
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12211
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12212
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12213
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12214
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12215
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12216
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12217
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12218
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12219
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12220
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12221
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12222
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12223
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12224
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12225
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12226
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12227
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12228
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12229
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12230
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12231
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12232
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12233
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12234
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12235
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12236
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12237
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12238
          },
          {
            "timestamp": "2026-05-28 22:32:58,684",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12239
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12240
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12241
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12242
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12243
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12244
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12245
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12246
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12247
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12248
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12249
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12250
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12251
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12252
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12253
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12254
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12255
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12256
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12257
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12258
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12259
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12260
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12261
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12262
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12263
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 12264
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12265
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12266
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12267
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 12268
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12269
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12270
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12271
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12272
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12273
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12274
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12275
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12276
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12277
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12278
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12279
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12280
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12281
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12282
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12283
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12284
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12285
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12286
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12287
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12288
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12289
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12290
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12291
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12292
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12293
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12294
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12295
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12296
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12297
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12298
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12299
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12300
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12301
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12302
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12303
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12304
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12305
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12306
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12307
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12308
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12309
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12310
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12311
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12312
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12313
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12314
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12315
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12316
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12317
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12318
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12319
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12320
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12321
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12322
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12323
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12324
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12325
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12326
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12327
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12328
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12329
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12330
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12331
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12332
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12333
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12334
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12335
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12336
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12337
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12338
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12339
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12340
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12341
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12342
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12343
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12344
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12345
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12346
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12347
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12348
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12349
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12350
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12351
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12352
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12353
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12354
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12355
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12356
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12357
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12358
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12359
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12360
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12361
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12362
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12363
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12364
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12365
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12366
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12367
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12368
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12369
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12370
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12371
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12372
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12373
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12374
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12375
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12376
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12377
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12378
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12379
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12380
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12381
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12382
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12383
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12384
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12385
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12386
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12387
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12388
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12389
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12390
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12391
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000468"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12392
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12393
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12394
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12395
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12396
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12397
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12398
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12399
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12400
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12401
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12402
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12403
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12404
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12405
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12406
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12407
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12408
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12409
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12410
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12411
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12412
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12413
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12414
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12415
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12416
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12417
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12418
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12419
          },
          {
            "timestamp": "2026-05-28 22:32:58,700",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12420
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12421
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 12422
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12423
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 12424
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 12425
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12426
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12427
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12428
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12429
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12430
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12431
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12432
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12433
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12434
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12435
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12436
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000046c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12437
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12438
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12439
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12440
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12441
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12442
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12443
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12444
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12445
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12446
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12447
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12448
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12449
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12450
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12451
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12452
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12453
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12454
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12455
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12456
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12457
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000046c"
              }
            ],
            "repeated": 0,
            "id": 12458
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12459
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12460
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12461
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 12462
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12463
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12464
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12465
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12466
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12467
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12468
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12469
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12470
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12471
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12472
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12473
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12474
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12475
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12476
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12477
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12478
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12479
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12480
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12481
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12482
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12483
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12484
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12485
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12486
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12487
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12488
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12489
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12490
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12491
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12492
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12493
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12494
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12495
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12496
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12497
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12498
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12499
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12500
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12501
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12502
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12503
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12504
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12505
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12506
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12507
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12508
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12509
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12510
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12511
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12512
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12513
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12514
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12515
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12516
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12517
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12518
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12519
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12520
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12521
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12522
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12523
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12524
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12525
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12526
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12527
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12528
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12529
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12530
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12531
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12532
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12533
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12534
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12535
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12536
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12537
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12538
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12539
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12540
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12541
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000470"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12542
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12543
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12544
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12545
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12546
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12547
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12548
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12549
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12550
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12551
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12552
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12553
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12554
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12555
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x008\\x0e\\x00\\x00`\\x11\\x00\\x00\\x00\\x00\\x00\\x00R\\xb1\\x82\\xef\\xf1\\xee\\xdc\\x01\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x008\\x0e\\x00\\x00 \\x00\\x00\\x008\\x10=\\xeb\\x8c\\x01\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x00&\\x03\\x13\\xc0\\x01\\x00\\x00\\x00\\x802\\x00\\x00`\\x1f\\x00\\x00^\\xf2x\\xef\\xf1\\xee\\xdc\\x01'\\xbc\\x04%\\x8b\\x0e\\xed_z\\x9f\\xd8ir\\x08b\\x85\\x00\\x00\\x00\\x0b\\x05\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\xba\\x83\\xb9\\xfdt\\x00\\x00\\x00\rm\n\\x80\\xf1\\xee\\x05\\x00Oq\n\\x80\\xf1\\xee\\xdc\\x01P\\x00\\x0c\\x00\\x01\\x00E\\x00E\\x00Microsoft.Windows.Update.Orchestrator.Decisions\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00\\xc8\\x00\\x0b\\x00\\x00\\x00\\xbe\\x00\\xbe\\x00\\x00Decision\\x00Part"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 12556
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 12557
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12558
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12559
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12560
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12561
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12562
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12563
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12564
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12565
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12566
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12567
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12568
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12569
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12570
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12571
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12572
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12573
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12574
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12575
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12576
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12577
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12578
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12579
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12580
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12581
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12582
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12583
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12584
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12585
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12586
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12587
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12588
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 12589
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12590
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12591
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12592
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12593
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12594
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12595
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 12596
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12597
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12598
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12599
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12600
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12601
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12602
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12603
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12604
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12605
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12606
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12607
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000470"
              }
            ],
            "repeated": 0,
            "id": 12608
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12609
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12610
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12611
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12612
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12613
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12614
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12615
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12616
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12617
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12618
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12619
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12620
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12621
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12622
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12623
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12624
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12625
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12626
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12627
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12628
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12629
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12630
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12631
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12632
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12633
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12634
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12635
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12636
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12637
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12638
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12639
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12640
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12641
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12642
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12643
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12644
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12645
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12646
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12647
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12648
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12649
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12650
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12651
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12652
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12653
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12654
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12655
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12656
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12657
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12658
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12659
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12660
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12661
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12662
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12663
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12664
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12665
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12666
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12667
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12668
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12669
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12670
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12671
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12672
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12673
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12674
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12675
          },
          {
            "timestamp": "2026-05-28 22:32:58,715",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12676
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12677
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12678
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12679
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12680
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12681
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12682
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12683
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12684
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12685
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12686
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12687
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12688
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12689
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12690
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12691
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12692
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12693
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12694
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12695
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12696
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12697
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12698
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12699
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12700
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12701
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12702
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12703
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12704
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12705
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12706
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12707
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12708
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12709
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12710
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12711
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12712
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12713
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12714
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12715
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12716
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12717
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12718
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12719
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12720
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12721
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12722
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12723
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12724
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12725
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12726
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12727
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12728
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12729
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12730
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12731
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12732
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12733
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12734
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12735
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12736
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12737
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12738
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12739
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12740
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12741
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12742
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12743
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12744
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12745
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12746
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12747
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12748
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12749
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12750
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12751
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12752
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12753
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12754
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12755
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12756
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12757
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12758
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12759
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12760
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12761
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12762
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12763
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12764
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12765
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12766
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12767
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12768
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12769
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12770
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12771
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12772
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12773
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12774
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12775
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12776
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12777
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12778
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12779
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12780
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12781
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12782
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12783
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12784
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12785
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12786
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12787
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12788
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12789
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12790
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12791
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12792
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12793
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12794
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12795
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12796
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 12797
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12798
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12799
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12800
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12801
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12802
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12803
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12804
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12805
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12806
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12807
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12808
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12809
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12810
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12811
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12812
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 12813
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12814
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12815
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12816
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 12817
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12818
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12819
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12820
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 12821
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12822
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12823
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12824
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12825
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 12826
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12827
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12828
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12829
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 12830
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 12831
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12832
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12833
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12834
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12835
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12836
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12837
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12838
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12839
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12840
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12841
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12842
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12843
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12844
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12845
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12846
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12847
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12848
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12849
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12850
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12851
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12852
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12853
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12854
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12855
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 12856
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12857
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12858
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 12859
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12860
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 12861
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 12862
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12863
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12864
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12865
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12866
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12867
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12868
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12869
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 12870
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12871
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12872
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12873
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12874
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12875
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12876
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 12877
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12878
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12879
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12880
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12881
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12882
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12883
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12884
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12885
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12886
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12887
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 12888
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12889
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12890
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12891
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12892
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12893
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12894
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12895
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 12896
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 12897
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 12898
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12899
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12900
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12901
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12902
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12903
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12904
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12905
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12906
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12907
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12908
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12909
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12910
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12911
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12912
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12913
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12914
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12915
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12916
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12917
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12918
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12919
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12920
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12921
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12922
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12923
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12924
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12925
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12926
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12927
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12928
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12929
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12930
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12931
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12932
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12933
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12934
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12935
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 12936
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 12937
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 12938
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12939
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12940
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12941
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12942
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12943
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 12944
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12945
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 12946
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12947
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12948
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 12949
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12950
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12951
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12952
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12953
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12954
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12955
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12956
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12957
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 12958
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12959
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12960
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12961
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12962
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12963
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12964
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12965
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12966
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12967
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12968
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12969
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12970
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12971
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12972
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12973
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12974
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12975
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12976
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12977
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12978
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12979
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12980
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 12981
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12982
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 12983
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 12984
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 12985
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 12986
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 12987
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 12988
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 12989
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 12990
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12991
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12992
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12993
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12994
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12995
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 12996
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 12997
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 12998
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 12999
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13000
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13001
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13002
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13003
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13004
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13005
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13006
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13007
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13008
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 13009
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13010
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13011
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13012
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000468"
              }
            ],
            "repeated": 0,
            "id": 13013
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13014
          },
          {
            "timestamp": "2026-05-28 22:32:58,731",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13015
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13016
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13017
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13018
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13019
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13020
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13021
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13022
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13023
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13024
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13025
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13026
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13027
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13028
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13029
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13030
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13031
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13032
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13033
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13034
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13035
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13036
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13037
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13038
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13039
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13040
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13041
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13042
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13043
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13044
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13045
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13046
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13047
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13048
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13049
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13050
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13051
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13052
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13053
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13054
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13055
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13056
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13057
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13058
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13059
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13060
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13061
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13062
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13063
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13064
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13065
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13066
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13067
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13068
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13069
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13070
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13071
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13072
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13073
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13074
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13075
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13076
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 13077
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13078
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13079
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13080
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13081
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13082
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13083
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13084
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13085
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13086
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13087
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13088
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13089
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13090
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13091
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13092
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13093
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13094
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13095
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13096
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13097
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13098
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13099
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13100
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13101
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13102
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13103
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13104
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000047c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13105
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13106
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13107
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13108
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13109
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13110
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13111
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13112
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13113
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13114
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13115
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13116
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13117
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13118
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13119
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13120
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13121
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13122
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13123
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13124
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13125
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13126
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13127
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13128
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13129
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13130
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13131
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13132
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13133
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13134
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13135
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13136
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13137
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13138
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13139
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 13140
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13141
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 13142
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 13143
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13144
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13145
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13146
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13147
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13148
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13149
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13150
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13151
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13152
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13153
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13154
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13155
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13156
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13157
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13158
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13159
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13160
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13161
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13162
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13163
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13164
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13165
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13166
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13167
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13168
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13169
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13170
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13171
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13172
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13173
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13174
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13175
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13176
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13177
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13178
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13179
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13180
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13181
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13182
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13183
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13184
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13185
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13186
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13187
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13188
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13189
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13190
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13191
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13192
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13193
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13194
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13195
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13196
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13197
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13198
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13199
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13200
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13201
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13202
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13203
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13204
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13205
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13206
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              }
            ],
            "repeated": 0,
            "id": 13207
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13208
          },
          {
            "timestamp": "2026-05-28 22:32:58,747",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13209
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13210
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13211
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13212
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13213
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13214
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13215
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13216
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13217
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13218
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13219
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13220
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13221
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13222
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13223
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13224
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13225
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13226
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13227
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13228
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13229
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 13230
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13231
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13232
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13233
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 13234
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13235
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13236
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13237
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13238
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13239
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13240
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13241
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13242
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13243
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13244
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13245
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13246
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13247
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13248
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13249
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13250
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13251
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13252
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13253
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13254
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13255
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13256
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13257
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13258
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13259
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13260
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13261
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13262
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13263
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13264
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13265
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13266
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13267
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x008\\x0e\\x00\\x00`\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xef|\\x89\\xef\\xf1\\xee\\xdc\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x008\\x0e\\x00\\x00 \\x00\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x008\\x00=\\xeb\\x8c\\x01\\x00\\x00&\\x03\\x13\\xc0\\x01\\x00\\x00\\x00\\x802\\x00\\x00`\\x1f\\x00\\x00R\\xb1\\x82\\xef\\xf1\\xee\\xdc\\x01'\\xbc\\x04%\\x8b\\x0e\\xed_z\\x9f\\xd8ir\\x08b\\x85\\x00\\x00\\x00\\x0b\\x05\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00h\\xa5\\xd8\\x0bu\\x00\\x00\\x00\rm\n\\x80\\xf1\\xee\\x04\\x00vr\n\\x80\\xf1\\xee\\xdc\\x01P\\x00\\x0c\\x00\\x01\\x00E\\x00E\\x00Microsoft.Windows.Update.Orchestrator.Decisions\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00\\xc8\\x00\\x0b\\x00\\x00\\x00\\xbe\\x00\\xbe\\x00\\x00Decision\\x00Part"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 13268
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 13269
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13270
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13271
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13272
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13273
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13274
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13275
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13276
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13277
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13278
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13279
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13280
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13281
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13282
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13283
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13284
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13285
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13286
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13287
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13288
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13289
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13290
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13291
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13292
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13293
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13294
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13295
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13296
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13297
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13298
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13299
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 13300
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 13301
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 13302
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 13303
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 13304
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 13305
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 13306
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 13307
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 13308
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13309
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 13310
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 13311
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 13312
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13313
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 13314
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13315
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13316
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 13317
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13318
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13319
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 13320
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13321
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13322
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 13323
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13324
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13325
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 13326
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13327
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13328
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 13329
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13330
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13331
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 13332
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13333
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13334
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 13335
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13336
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13337
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 13338
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13339
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13340
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 13341
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13342
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13343
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 13344
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13345
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13346
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 13347
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13348
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13349
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13350
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 13351
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13352
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13353
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 13354
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13355
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13356
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13357
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13358
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13359
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13360
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13361
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13362
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 13363
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13364
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13365
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 13366
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13367
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13368
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 13369
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13370
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13371
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 13372
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13373
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13374
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 13375
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13376
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 13377
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 13378
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 13379
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 13380
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13381
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13382
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13383
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13384
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13385
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13386
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13387
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13388
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13389
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13390
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13391
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13392
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13393
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 13394
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13395
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 13396
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13397
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13398
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 13399
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13400
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13401
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 13402
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13403
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13404
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 13405
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13406
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13407
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13408
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13409
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13410
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13411
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13412
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13413
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13414
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13415
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13416
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13417
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13418
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13419
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13420
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13421
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13422
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13423
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13424
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13425
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13426
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13427
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13428
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13429
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13430
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13431
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13432
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13433
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13434
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13435
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13436
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13437
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13438
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13439
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13440
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13441
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13442
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13443
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13444
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13445
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13446
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13447
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13448
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13449
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13450
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13451
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13452
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13453
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13454
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13455
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13456
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13457
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13458
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13459
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13460
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13461
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13462
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13463
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13464
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13465
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13466
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13467
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13468
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13469
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13470
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13471
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13472
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 13473
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13474
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13475
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 13476
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13477
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13478
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 13479
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13480
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13481
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13482
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13483
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13484
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13485
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 13486
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 13487
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 13488
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13489
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13490
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13491
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 13492
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13493
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13494
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 13495
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13496
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13497
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 13498
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13499
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13500
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 13501
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13502
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13503
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 13504
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13505
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13506
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13507
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13508
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13509
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 13510
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13511
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13512
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 13513
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13514
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13515
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 13516
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13517
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13518
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 13519
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13520
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13521
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13522
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13523
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13524
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13525
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13526
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13527
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13528
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13529
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13530
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13531
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13532
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13533
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13534
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13535
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13536
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13537
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13538
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13539
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13540
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13541
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13542
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13543
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13544
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13545
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13546
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 13547
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13548
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13549
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13550
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13551
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13552
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13553
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13554
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13555
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 13556
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13557
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13558
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13559
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 13560
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 13561
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13562
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 13563
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13564
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13565
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13566
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 13567
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 13568
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13569
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13570
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13571
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13572
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 13573
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 13574
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13575
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13576
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13577
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13578
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13579
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13580
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13581
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13582
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13583
          },
          {
            "timestamp": "2026-05-28 22:32:58,762",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13584
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13585
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13586
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 13587
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000048c"
              }
            ],
            "repeated": 0,
            "id": 13588
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13589
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13590
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13591
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13592
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13593
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13594
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13595
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13596
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13597
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13598
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13599
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13600
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13601
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13602
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13603
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13604
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13605
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13606
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13607
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13608
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13609
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13610
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13611
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13612
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13613
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13614
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13615
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13616
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13617
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13618
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13619
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13620
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13621
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13622
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13623
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 13624
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13625
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13626
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13627
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13628
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13629
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13630
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13631
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13632
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13633
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13634
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13635
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13636
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13637
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13638
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13639
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13640
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13641
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13642
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13643
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13644
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13645
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13646
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13647
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13648
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13649
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13650
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13651
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13652
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13653
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13654
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13655
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13656
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13657
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13658
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13659
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13660
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13661
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13662
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13663
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13664
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13665
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13666
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13667
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13668
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13669
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13670
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13671
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13672
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13673
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13674
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13675
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13676
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13677
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13678
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13679
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13680
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13681
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13682
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13683
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13684
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13685
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13686
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13687
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13688
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13689
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13690
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13691
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13692
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13693
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13694
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13695
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13696
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13697
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13698
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13699
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13700
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13701
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13702
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13703
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13704
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13705
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13706
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13707
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13708
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 13709
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13710
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13711
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13712
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13713
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13714
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13715
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13716
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13717
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13718
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13719
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13720
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13721
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13722
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13723
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13724
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13725
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13726
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13727
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13728
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13729
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13730
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13731
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13732
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13733
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13734
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13735
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13736
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13737
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13738
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 13739
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13740
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13741
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13742
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13743
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13744
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13745
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13746
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13747
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13748
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13749
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13750
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13751
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13752
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13753
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13754
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13755
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13756
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13757
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13758
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13759
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13760
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13761
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13762
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 13763
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13764
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13765
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13766
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13767
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13768
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13769
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13770
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13771
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13772
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13773
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13774
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13775
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13776
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13777
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13778
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13779
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13780
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13781
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13782
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 13783
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13784
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 13785
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13786
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13787
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13788
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13789
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13790
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000490"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13791
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13792
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13793
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13794
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13795
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000490"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 13796
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 13797
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13798
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13799
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13800
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13801
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 13802
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 13803
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13804
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13805
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 13806
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 13807
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 13808
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13809
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 13810
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 13811
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13812
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13813
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 13814
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 13815
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 13816
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 13817
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13818
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 13819
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13820
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 13821
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 13822
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 13823
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13824
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 13825
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 13826
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 13827
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 13828
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000494"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 13829
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 13830
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000490"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 13831
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 13832
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 13833
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 13834
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 13835
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 13836
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 13837
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 13838
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13839
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 13840
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 13841
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 13842
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13843
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 13844
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13845
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13846
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 13847
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13848
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000490"
              }
            ],
            "repeated": 0,
            "id": 13849
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 13850
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13851
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13852
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 13853
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13854
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13855
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 13856
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13857
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13858
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 13859
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13860
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13861
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 13862
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13863
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13864
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 13865
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13866
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13867
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 13868
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13869
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13870
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 13871
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13872
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13873
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 13874
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13875
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13876
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 13877
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13878
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13879
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13880
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 13881
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13882
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13883
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 13884
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13885
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13886
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13887
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13888
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13889
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13890
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13891
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13892
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 13893
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13894
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13895
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 13896
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13897
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13898
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 13899
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13900
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13901
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 13902
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13903
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13904
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 13905
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13906
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 13907
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000478"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 13908
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 13909
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 13910
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13911
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13912
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13913
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13914
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13915
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13916
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13917
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13918
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13919
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13920
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13921
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13922
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13923
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 13924
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13925
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 13926
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13927
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13928
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 13929
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13930
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13931
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 13932
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13933
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13934
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 13935
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13936
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13937
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13938
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13939
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13940
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 13941
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13942
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13943
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13944
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13945
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13946
          },
          {
            "timestamp": "2026-05-28 22:32:58,778",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13947
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13948
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13949
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13950
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13951
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13952
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13953
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13954
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 13955
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13956
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13957
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 13958
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13959
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13960
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13961
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13962
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13963
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13964
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13965
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13966
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 13967
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13968
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13969
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 13970
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13971
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13972
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 13973
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13974
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13975
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 13976
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13977
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13978
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13979
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13980
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13981
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13982
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13983
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13984
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 13985
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13986
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13987
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 13988
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13989
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13990
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 13991
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13992
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13993
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 13994
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13995
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 13996
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 13997
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 13998
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 13999
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14000
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14001
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14002
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14003
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14004
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14005
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14006
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14007
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14008
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14009
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14010
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14011
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14012
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14013
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14014
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14015
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 14016
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 14017
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 14018
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14019
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14020
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14021
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 14022
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14023
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14024
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 14025
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14026
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14027
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 14028
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14029
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14030
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 14031
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14032
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14033
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 14034
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14035
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14036
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14037
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14038
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14039
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 14040
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14041
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14042
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 14043
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14044
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14045
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 14046
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14047
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14048
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 14049
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14050
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14051
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14052
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14053
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14054
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14055
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14056
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14057
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14058
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14059
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14060
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14061
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14062
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14063
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14064
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14065
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14066
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14067
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14068
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14069
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14070
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14071
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14072
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14073
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14074
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14075
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14076
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14077
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000478"
              }
            ],
            "repeated": 0,
            "id": 14078
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14079
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14080
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14081
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14082
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14083
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14084
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14085
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 14086
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14087
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 14088
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14089
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14090
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14091
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 14092
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 14093
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14094
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14095
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14096
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14097
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14098
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14099
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14100
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14101
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14102
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14103
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14104
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14105
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14106
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14107
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14108
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14109
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14110
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14111
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14112
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14113
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14114
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14115
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14116
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 14117
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 14118
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14119
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14120
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14121
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14122
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14123
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14124
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14125
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14126
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14127
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14128
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14129
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14130
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14131
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14132
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14133
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 14134
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14135
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14136
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14137
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 14138
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14139
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14140
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14141
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14142
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14143
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14144
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14145
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14146
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14147
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14148
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14149
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14150
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14151
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14152
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14153
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 14154
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14155
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14156
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14157
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14158
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14159
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14160
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14161
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14162
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14163
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14164
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14165
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14166
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14167
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14168
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14169
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14170
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14171
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14172
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14173
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14174
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14175
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14176
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14177
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14178
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14179
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14180
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14181
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14182
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14183
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14184
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14185
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14186
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14187
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14188
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14189
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14190
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14191
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14192
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14193
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14194
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14195
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14196
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14197
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14198
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14199
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14200
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14201
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14202
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14203
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14204
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14205
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14206
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14207
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14208
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14209
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14210
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14211
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14212
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14213
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14214
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14215
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14216
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14217
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14218
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14219
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14220
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14221
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14222
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14223
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14224
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14225
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14226
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14227
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14228
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14229
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14230
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14231
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14232
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14233
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14234
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14235
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14236
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14237
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14238
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14239
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14240
          },
          {
            "timestamp": "2026-05-28 22:32:58,793",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14241
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14242
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14243
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14244
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14245
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14246
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14247
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14248
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14249
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14250
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14251
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14252
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14253
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14254
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14255
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14256
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14257
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14258
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14259
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14260
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14261
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14262
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14263
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14264
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14265
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14266
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14267
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14268
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14269
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14270
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14271
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14272
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14273
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14274
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14275
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14276
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14277
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14278
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14279
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14280
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14281
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14282
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14283
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14284
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14285
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14286
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14287
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14288
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14289
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14290
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14291
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14292
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 14293
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14294
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14295
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14296
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14297
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14298
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14299
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14300
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14301
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14302
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14303
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14304
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14305
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14306
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14307
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14308
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14309
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14310
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14311
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14312
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14313
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14314
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14315
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14316
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14317
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14318
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14319
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14320
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000049c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14321
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14322
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14323
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14324
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14325
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000049c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14326
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14327
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14328
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14329
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14330
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14331
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14332
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14333
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14334
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14335
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14336
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14337
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14338
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14339
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14340
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14341
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14342
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14343
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14344
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14345
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14346
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14347
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14348
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14349
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14350
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14351
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14352
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14353
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14354
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14355
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 14356
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14357
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 14358
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 14359
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14360
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14361
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14362
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14363
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14364
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14365
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000049c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14366
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14367
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14368
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14369
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14370
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x0000049c"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14371
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14372
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14373
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14374
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14375
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14376
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14377
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14378
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14379
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14380
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14381
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14382
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14383
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14384
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14385
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14386
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14387
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14388
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14389
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14390
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14391
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 14392
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14393
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14394
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14395
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000498"
              }
            ],
            "repeated": 0,
            "id": 14396
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14397
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14398
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14399
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14400
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14401
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14402
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14403
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14404
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14405
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14406
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14407
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14408
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14409
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14410
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14411
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14412
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14413
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14414
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14415
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14416
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14417
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14418
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14419
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14420
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14421
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14422
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14423
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14424
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14425
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14426
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14427
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14428
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14429
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14430
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14431
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14432
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14433
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14434
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14435
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14436
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14437
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14438
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14439
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14440
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14441
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14442
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14443
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14444
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14445
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14446
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14447
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14448
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14449
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000049c"
              }
            ],
            "repeated": 0,
            "id": 14450
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14451
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14452
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14453
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14454
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14455
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14456
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14457
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14458
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14459
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14460
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14461
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14462
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14463
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14464
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14465
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14466
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14467
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14468
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14469
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14470
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14471
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14472
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14473
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14474
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14475
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14476
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14477
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14478
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14479
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14480
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14481
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14482
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14483
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14484
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x00@\\x0e\\x00\\x00p\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xe1\\xbb\\x91\\xef\\xf1\\xee\\xdc\\x01\\x07\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00@\\x0e\\x00\\x00 \\x00\\x00\\x008\\x10=\\xeb\\x8c\\x01\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x00&\\x03\\x13\\xc0\\x01\\x00\\x00\\x00\\x802\\x00\\x00`\\x1f\\x00\\x00\\xef|\\x89\\xef\\xf1\\xee\\xdc\\x01'\\xbc\\x04%\\x8b\\x0e\\xed_z\\x9f\\xd8ir\\x08b\\x85\\x00\\x00\\x00\\x0b\\x05\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\x18\\x9d~\\x15u\\x00\\x00\\x00\rm\n\\x80\\xf1\\xee\\x04\\x00wr\n\\x80\\xf1\\xee\\xdc\\x01P\\x00\\x0c\\x00\\x01\\x00E\\x00E\\x00Microsoft.Windows.Update.Orchestrator.Decisions\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00\\xc8\\x00\\x0b\\x00\\x00\\x00\\xbe\\x00\\xbe\\x00\\x00Decision\\x00Part"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 14485
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 14486
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14487
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14488
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14489
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14490
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14491
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14492
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14493
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14494
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14495
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14496
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14497
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14498
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14499
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14500
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14501
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14502
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14503
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14504
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14505
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14506
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14507
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14508
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14509
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14510
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14511
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14512
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14513
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14514
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14515
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 14516
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 14517
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 14518
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 14519
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 14520
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 14521
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 14522
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 14523
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 14524
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14525
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 14526
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 14527
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 14528
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14529
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 14530
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14531
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14532
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 14533
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14534
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14535
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 14536
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14537
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14538
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 14539
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14540
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14541
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 14542
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14543
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14544
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 14545
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14546
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14547
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 14548
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14549
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14550
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 14551
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14552
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14553
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 14554
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14555
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14556
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 14557
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14558
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14559
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 14560
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14561
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14562
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 14563
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14564
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14565
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14566
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 14567
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14568
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14569
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 14570
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14571
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14572
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14573
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14574
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14575
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14576
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14577
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14578
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 14579
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14580
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14581
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 14582
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14583
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14584
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 14585
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14586
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14587
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 14588
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14589
          },
          {
            "timestamp": "2026-05-28 22:32:58,809",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 14590
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 14591
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14592
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 14593
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000484"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 14594
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 14595
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 14596
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14597
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14598
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14599
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14600
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14601
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14602
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14603
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14604
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14605
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14606
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14607
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14608
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14609
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 14610
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14611
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 14612
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14613
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14614
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 14615
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14616
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14617
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 14618
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14619
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14620
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 14621
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14622
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14623
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14624
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14625
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14626
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14627
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14628
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14629
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14630
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14631
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14632
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14633
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14634
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14635
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14636
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14637
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14638
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14639
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14640
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14641
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14642
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14643
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14644
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14645
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14646
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14647
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14648
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14649
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14650
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14651
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14652
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14653
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14654
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14655
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14656
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14657
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14658
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14659
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14660
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14661
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14662
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14663
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14664
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14665
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14666
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14667
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14668
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14669
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14670
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14671
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14672
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14673
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14674
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14675
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14676
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14677
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14678
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14679
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14680
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14681
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14682
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14683
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14684
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14685
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14686
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14687
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14688
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14689
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14690
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14691
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14692
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14693
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14694
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14695
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14696
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 14697
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14698
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 14699
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 14700
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14701
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 14702
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 14703
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 14704
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14705
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 14706
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14707
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14708
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14709
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14710
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14711
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14712
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14713
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14714
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 14715
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14716
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14717
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14718
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14719
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14720
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14721
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 14722
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14723
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14724
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14725
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14726
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14727
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14728
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14729
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14730
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14731
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14732
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 14733
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14734
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14735
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14736
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14737
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14738
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14739
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14740
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14741
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14742
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14743
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14744
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14745
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 14746
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14747
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14748
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14749
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14750
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14751
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14752
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14753
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14754
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14755
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14756
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14757
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14758
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14759
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14760
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14761
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14762
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14763
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14764
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14765
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14766
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14767
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14768
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14769
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14770
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14771
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14772
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14773
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14774
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14775
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14776
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14777
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14778
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14779
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14780
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14781
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14782
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 14783
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 14784
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14785
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14786
          },
          {
            "timestamp": "2026-05-28 22:32:58,825",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14787
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14788
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14789
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14790
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14791
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14792
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14793
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14794
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14795
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14796
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14797
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14798
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14799
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14800
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14801
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14802
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14803
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14804
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14805
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14806
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14807
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14808
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14809
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14810
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14811
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14812
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14813
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14814
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14815
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14816
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14817
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14818
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14819
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14820
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14821
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14822
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14823
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14824
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14825
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14826
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14827
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14828
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14829
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14830
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14831
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14832
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14833
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14834
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14835
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14836
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14837
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14838
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14839
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14840
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14841
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14842
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14843
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14844
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14845
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14846
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14847
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14848
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14849
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14850
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14851
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14852
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14853
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14854
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14855
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14856
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14857
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14858
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14859
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14860
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14861
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14862
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14863
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14864
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14865
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14866
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14867
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 14868
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14869
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14870
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14871
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14872
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14873
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14874
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14875
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14876
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14877
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14878
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14879
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14880
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14881
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14882
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14883
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14884
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14885
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14886
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14887
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14888
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14889
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14890
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14891
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14892
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14893
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14894
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14895
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14896
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14897
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 14898
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14899
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14900
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14901
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14902
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14903
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14904
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14905
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14906
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14907
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14908
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14909
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14910
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14911
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14912
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14913
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14914
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14915
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14916
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14917
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14918
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14919
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14920
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14921
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 14922
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14923
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14924
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14925
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14926
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14927
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14928
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14929
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14930
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14931
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14932
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14933
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14934
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14935
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14936
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14937
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14938
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14939
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14940
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14941
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 14942
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14943
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 14944
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14945
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14946
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14947
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14948
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14949
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14950
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14951
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14952
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14953
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14954
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 14955
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 14956
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14957
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14958
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14959
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14960
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 14961
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 14962
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14963
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14964
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 14965
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 14966
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 14967
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14968
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 14969
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 14970
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14971
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14972
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 14973
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 14974
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 14975
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 14976
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14977
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 14978
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14979
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 14980
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 14981
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 14982
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 14983
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 14984
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 14985
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 14986
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 14987
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 14988
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 14989
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "35"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 14990
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Client.OS.rs2.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 14991
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 14992
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "Microsoft.NETFX.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 14993
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "Windows.Appraiser.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 14994
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "Windows.AppraiserData.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 14995
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "Windows.Autopilot.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 14996
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 14997
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 14998
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "Windows.OOBE.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 14999
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 15000
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\"
              }
            ],
            "repeated": 0,
            "id": 15001
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15002
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 15003
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15004
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15005
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 15006
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15007
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15008
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 15009
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15010
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15011
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64"
              }
            ],
            "repeated": 0,
            "id": 15012
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15013
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15014
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 15015
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15016
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15017
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64"
              }
            ],
            "repeated": 0,
            "id": 15018
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15019
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15020
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 15021
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15022
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15023
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64"
              }
            ],
            "repeated": 0,
            "id": 15024
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15025
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15026
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 15027
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15028
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15029
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64"
              }
            ],
            "repeated": 0,
            "id": 15030
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15031
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15032
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 15033
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15034
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15035
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64"
              }
            ],
            "repeated": 0,
            "id": 15036
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15037
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15038
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15039
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 15040
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15041
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15042
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64"
              }
            ],
            "repeated": 0,
            "id": 15043
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15044
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15045
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 15046
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15047
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15048
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64"
              }
            ],
            "repeated": 0,
            "id": 15049
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15050
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15051
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 15052
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15053
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15054
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64"
              }
            ],
            "repeated": 0,
            "id": 15055
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15056
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15057
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 15058
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15059
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15060
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64"
              }
            ],
            "repeated": 0,
            "id": 15061
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15062
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15063
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 15064
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15065
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 15066
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryInfoKeyW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a0"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "SubKeyCount",
                "value": "0"
              },
              {
                "name": "MaxSubKeyLength",
                "value": "44"
              },
              {
                "name": "MaxClassLength",
                "value": "0"
              },
              {
                "name": "ValueCount",
                "value": "0"
              },
              {
                "name": "MaxValueNameLength",
                "value": "0"
              },
              {
                "name": "MaxValueLength",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 15067
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "0"
              },
              {
                "name": "Name",
                "value": "Hammer.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 15068
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "1"
              },
              {
                "name": "Name",
                "value": "MSRT.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 15069
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "2"
              },
              {
                "name": "Name",
                "value": "SedimentPack.amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 15070
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "3"
              },
              {
                "name": "Name",
                "value": "{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15071
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "4"
              },
              {
                "name": "Name",
                "value": "{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15072
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "5"
              },
              {
                "name": "Name",
                "value": "{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15073
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "6"
              },
              {
                "name": "Name",
                "value": "{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15074
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "7"
              },
              {
                "name": "Name",
                "value": "{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15075
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "8"
              },
              {
                "name": "Name",
                "value": "{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15076
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "9"
              },
              {
                "name": "Name",
                "value": "{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15077
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "10"
              },
              {
                "name": "Name",
                "value": "{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15078
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "11"
              },
              {
                "name": "Name",
                "value": "{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15079
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "12"
              },
              {
                "name": "Name",
                "value": "{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15080
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "13"
              },
              {
                "name": "Name",
                "value": "{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15081
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "14"
              },
              {
                "name": "Name",
                "value": "{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15082
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegEnumKeyExW",
            "status": false,
            "return": "0x00000103",
            "pretty_return": "NO_MORE_ITEMS",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "Index",
                "value": "15"
              },
              {
                "name": "Name",
                "value": ""
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\"
              }
            ],
            "repeated": 0,
            "id": 15083
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15084
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 15085
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15086
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15087
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64"
              }
            ],
            "repeated": 0,
            "id": 15088
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15089
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15090
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 15091
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15092
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15093
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64"
              }
            ],
            "repeated": 0,
            "id": 15094
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15095
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15096
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 15097
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15098
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15099
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64"
              }
            ],
            "repeated": 0,
            "id": 15100
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15101
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15102
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15103
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15104
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15105
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15106
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15107
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15108
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15109
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15110
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15111
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15112
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15113
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15114
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15115
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15116
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15117
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15118
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15119
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15120
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15121
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15122
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15123
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15124
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15125
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15126
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15127
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15128
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15129
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15130
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15131
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15132
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15133
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15134
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15135
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15136
          },
          {
            "timestamp": "2026-05-28 22:32:58,840",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15137
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15138
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15139
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15140
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15141
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15142
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15143
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15144
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15145
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15146
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15147
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15148
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15149
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15150
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15151
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15152
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15153
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15154
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15155
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15156
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15157
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15158
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15159
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15160
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15161
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15162
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15163
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15164
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15165
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15166
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15167
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15168
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15169
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Version"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version"
              }
            ],
            "repeated": 0,
            "id": 15170
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15171
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64"
              }
            ],
            "repeated": 0,
            "id": 15172
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "HiddenFromEnumeration"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration"
              }
            ],
            "repeated": 0,
            "id": 15173
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15174
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\"
              }
            ],
            "repeated": 0,
            "id": 15175
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b4938",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "System\\Platform\\DeviceTargetingInfo\\"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\"
              }
            ],
            "repeated": 0,
            "id": 15176
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64"
              }
            ],
            "repeated": 0,
            "id": 15177
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 15178
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "PrimaryOSProduct"
              },
              {
                "name": "Data",
                "value": "1"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct"
              }
            ],
            "repeated": 0,
            "id": 15179
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48b49d5",
            "parentcaller": "0x7ff6d48b539e",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15180
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15181
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15182
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15183
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15184
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15185
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15186
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15187
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval"
              }
            ],
            "repeated": 0,
            "id": 15188
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "32"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15189
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15190
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483fa98",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15191
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15192
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15193
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15194
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 15195
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15196
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15197
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15198
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15199
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15200
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15201
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15202
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15203
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15204
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15205
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15206
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a0"
              }
            ],
            "repeated": 0,
            "id": 15207
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15208
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15209
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15210
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15211
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15212
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15213
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15214
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15215
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15216
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15217
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15218
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 15219
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15220
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15221
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15222
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15223
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15224
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15225
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15226
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15227
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15228
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15229
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15230
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15231
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15232
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15233
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 15234
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15235
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15236
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15237
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15238
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 15239
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15240
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15241
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15242
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15243
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15244
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15245
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15246
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15247
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15248
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15249
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15250
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15251
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15252
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483e984",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15253
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15254
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15255
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 15256
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15257
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15258
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15259
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15260
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15261
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15262
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15263
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15264
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15265
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15266
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15267
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15268
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15269
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15270
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 15271
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15272
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15273
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15274
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15275
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 15276
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15277
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15278
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15279
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15280
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15281
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15282
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15283
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15284
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15285
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15286
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15287
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15288
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15289
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ecd5",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15290
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15291
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15292
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15293
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15294
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15295
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15296
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15297
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15298
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15299
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15300
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15301
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15302
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15303
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ed26",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15304
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15305
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15306
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15307
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15308
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15309
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15310
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15311
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15312
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15313
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15314
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15315
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15316
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15317
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15318
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15319
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15320
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15321
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15322
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15323
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15324
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15325
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15326
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15327
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15328
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15329
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15330
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15331
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15332
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15333
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15334
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15335
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15336
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15337
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15338
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15339
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15340
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15341
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15342
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15343
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15344
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15345
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15346
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15347
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15348
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15349
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15350
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15351
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15352
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15353
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15354
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15355
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15356
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15357
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15358
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15359
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15360
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15361
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15362
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15363
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15364
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15365
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15366
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15367
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15368
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15369
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15370
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15371
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15372
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15373
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15374
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15375
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15376
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15377
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15378
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15379
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15380
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15381
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15382
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15383
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15384
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15385
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15386
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15387
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15388
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15389
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15390
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15391
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15392
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15393
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15394
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ComplianceDeadlineExpeditedThreshold"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold"
              }
            ],
            "repeated": 0,
            "id": 15395
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15396
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15397
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15398
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15399
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15400
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15401
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15402
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15403
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15404
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15405
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15406
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15407
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15408
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15409
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 15410
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15411
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15412
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15413
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15414
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ConfigureDeadlineForQualityUpdates"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates"
              }
            ],
            "repeated": 0,
            "id": 15415
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483f918",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15416
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15417
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15418
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15419
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15420
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15421
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15422
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000488"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15423
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15424
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15425
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15426
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15427
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15428
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15429
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15430
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15431
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15432
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15433
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15434
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15435
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15436
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15437
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15438
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15439
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15440
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15441
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15442
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15443
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15444
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15445
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15446
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15447
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15448
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15449
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15450
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15451
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15452
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15453
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15454
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15455
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15456
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15457
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 15458
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15459
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 15460
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 15461
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15462
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15463
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15464
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15465
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15466
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15467
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15468
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15469
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15470
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15471
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15472
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15473
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15474
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15475
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15476
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15477
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15478
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15479
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15480
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15481
          },
          {
            "timestamp": "2026-05-28 22:32:58,856",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15482
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15483
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15484
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15485
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15486
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15487
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15488
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15489
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15490
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15491
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15492
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15493
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15494
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15495
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15496
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15497
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15498
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15499
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15500
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15501
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15502
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15503
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15504
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15505
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15506
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15507
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15508
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15509
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15510
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15511
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15512
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15513
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15514
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15515
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15516
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15517
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15518
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15519
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15520
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15521
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15522
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15523
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15524
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15525
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15526
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15527
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15528
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15529
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15530
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15531
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15532
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15533
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15534
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15535
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15536
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15537
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15538
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15539
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15540
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15541
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15542
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15543
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15544
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15545
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15546
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15547
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15548
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15549
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15550
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15551
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15552
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15553
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15554
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15555
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15556
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15557
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15558
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15559
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15560
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15561
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15562
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15563
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15564
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15565
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15566
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15567
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15568
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15569
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15570
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15571
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15572
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15573
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15574
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15575
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15576
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15577
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000480"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15578
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15579
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15580
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15581
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15582
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15583
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15584
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15585
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x00P\\x0e\\x00\\x00\\x80\\x11\\x00\\x00\\x00\\x00\\x00\\x00\\xd6\\xfb\\x99\\xef\\xf1\\xee\\xdc\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00P\\x0e\\x00\\x00 \\x00\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x008\\x00=\\xeb\\x8c\\x01\\x00\\x00*\\x03\\x13\\xc0\\x01\\x00\\x00\\x00\\x802\\x00\\x00`\\x1f\\x00\\x00\\xe1\\xbb\\x91\\xef\\xf1\\xee\\xdc\\x01'\\xbc\\x04%\\x8b\\x0e\\xed_z\\x9f\\xd8ir\\x08b\\x85\\x00\\x00\\x00\\x0b\\x05\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00\\xe8\\xb5s!u\\x00\\x00\\x00\rm\n\\x80\\xf1\\xee\\x00\\x00\\x82r\n\\x80\\xf1\\xee\\xdc\\x01P\\x00\\x0c\\x00\\x01\\x00E\\x00E\\x00Microsoft.Windows.Update.Orchestrator.Decisions\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00\\xc8\\x00\\x0b\\x00\\x00\\x00\\xbe\\x00\\xbe\\x00\\x00Decision\\x00Part"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 15586
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 15587
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15588
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15589
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15590
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15591
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15592
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15593
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15594
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000488"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15595
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15596
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15597
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15598
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15599
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000488"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15600
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 15601
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15602
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15603
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15604
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15605
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15606
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15607
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f0b2e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15608
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15609
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15610
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15611
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15612
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15613
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f2f8e",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15614
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15615
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15616
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15617
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15618
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15619
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4868083",
            "parentcaller": "0x7ff6d47f1106",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15620
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 15621
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15622
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15623
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15624
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15625
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15626
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15627
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15628
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15629
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15630
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15631
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15632
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15633
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15634
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15635
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15636
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15637
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15638
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15639
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15640
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15641
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15642
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              }
            ],
            "repeated": 0,
            "id": 15643
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "ActivePolicyCode"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode"
              }
            ],
            "repeated": 0,
            "id": 15644
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15645
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15646
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15647
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              }
            ],
            "repeated": 0,
            "id": 15648
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ActivePolicyCode"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode"
              }
            ],
            "repeated": 0,
            "id": 15649
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15650
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15651
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15652
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              }
            ],
            "repeated": 0,
            "id": 15653
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ActivePolicyCode"
              },
              {
                "name": "Data",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode"
              }
            ],
            "repeated": 0,
            "id": 15654
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15655
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15656
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15657
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15658
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15659
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15660
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15661
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15662
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 15663
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15664
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 15665
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 15666
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48402bb",
            "parentcaller": "0x7ff6d4840220",
            "category": "filesystem",
            "api": "GetDiskFreeSpaceExW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "DirectoryName",
                "value": "C:\\Windows\\system32"
              }
            ],
            "repeated": 0,
            "id": 15667
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15668
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15669
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef792",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15670
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15671
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15672
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15673
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15674
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15675
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15676
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15677
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15678
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15679
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15680
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15681
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1bea",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15682
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15683
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15684
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ef1be",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15685
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15686
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15687
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4869241",
            "parentcaller": "0x7ff6d47f1c89",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15688
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              }
            ],
            "repeated": 0,
            "id": 15689
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ActivePolicyCode"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode"
              }
            ],
            "repeated": 0,
            "id": 15690
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d48192c2",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15691
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15692
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15693
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              }
            ],
            "repeated": 0,
            "id": 15694
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ActivePolicyCode"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode"
              }
            ],
            "repeated": 0,
            "id": 15695
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15696
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15697
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15698
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess"
              }
            ],
            "repeated": 0,
            "id": 15699
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ActivePolicyCode"
              },
              {
                "name": "Data",
                "value": ""
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode"
              }
            ],
            "repeated": 0,
            "id": 15700
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4820e86",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15701
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15702
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15703
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15704
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15705
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15706
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15707
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15708
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d48262fb",
            "parentcaller": "0x7ff6d4815887",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "58"
              },
              {
                "name": "InputBuffer",
                "value": "\\x1d\\x8anx'\\xb4DC\\x92\\x07\t\\xe7\\x0b\\xdc\\xbe\\xa9\\xff\\xff\\xff\\xff"
              },
              {
                "name": "OutputBuffer",
                "value": "E!\\xbd\\xa3mN\\xc6A"
              }
            ],
            "repeated": 0,
            "id": 15709
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15710
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d482631d",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "Milliseconds",
                "value": "30000"
              }
            ],
            "repeated": 0,
            "id": 15711
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4826349",
            "parentcaller": "0x7ff6d4815887",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x0000047c"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 15712
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15713
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15714
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15715
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15716
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15717
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15718
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15719
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15720
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15721
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15722
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15723
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15724
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15725
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15726
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15727
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ea8e",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15728
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15729
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15730
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15731
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15732
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15733
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15734
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15735
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15736
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15737
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15738
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15739
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15740
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15741
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483eb37",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15742
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15743
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15744
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15745
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15746
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15747
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15748
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15749
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15750
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15751
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU"
              }
            ],
            "repeated": 0,
            "id": 15752
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15753
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15754
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ebbe",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15755
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15756
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15757
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15758
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15759
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15760
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15761
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15762
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15763
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15764
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15765
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15766
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15767
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15768
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec1c",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15769
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15770
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15771
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15772
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15773
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15774
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15775
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15776
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15777
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15778
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15779
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15780
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15781
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "AllowAutoUpdate"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate"
              }
            ],
            "repeated": 0,
            "id": 15782
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483ec28",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15783
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15784
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15785
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15786
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15787
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15788
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12584",
            "caller": "0x7fff98ca55d0",
            "parentcaller": "0x7fff98ca530e",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000278"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x10\\x00\\x008\\x0e\\x00\\x00P\\x11\\x00\\x00\\x00\\x00\\x00\\x00D\\xce\\x9b\\xef\\xf1\\xee\\xdc\\x01\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x008\\x0e\\x00\\x00 \\x00\\x00\\x008\\x10=\\xeb\\x8c\\x01\\x00\\x00\\xd8\\x9d\\xdb\\xea\\x8c\\x01\\x00\\x00*\\x03\\x13\\xc0\\x01\\x00\\x00\\x00\\x802\\x00\\x00`\\x1f\\x00\\x00\\xd6\\xfb\\x99\\xef\\xf1\\xee\\xdc\\x01'\\xbc\\x04%\\x8b\\x0e\\xed_z\\x9f\\xd8ir\\x08b\\x85\\x00\\x00\\x00\\x0b\\x05\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00@\\x00\\x00d\\xccX-u\\x00\\x00\\x00\rm\n\\x80\\xf1\\xee\\x05\\x00Qq\n\\x80\\xf1\\xee\\xdc\\x01P\\x00\\x0c\\x00\\x01\\x00E\\x00E\\x00Microsoft.Windows.Update.Orchestrator.Decisions\\x00\\x13\\x00\\x01\\x1asPO\\xcf\\x89\\x82G\\xb3\\xe0\\xdc\\xe8\\xc9\\x04v\\xba\\x00\\x00\\x00\\xc8\\x00\\x0b\\x00\\x00\\x00\\xbe\\x00\\xbe\\x00\\x00Decision\\x00Part"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 15789
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12584",
            "caller": "0x7fff98ca50c2",
            "parentcaller": "0x7fff98b67344",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000244"
              },
              {
                "name": "Milliseconds",
                "value": "18446744073709551615"
              },
              {
                "name": "Status",
                "value": "Infinite"
              }
            ],
            "repeated": 0,
            "id": 15790
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47efc16",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15791
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 15792
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 15793
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15794
          },
          {
            "timestamp": "2026-05-28 22:32:58,872",
            "thread_id": "12928",
            "caller": "0x7ff6d4824fbe",
            "parentcaller": "0x7ff6d4825040",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15795
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d482509c",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "OOBECompleteTimestamp"
              },
              {
                "name": "Data",
                "value": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp"
              }
            ],
            "repeated": 0,
            "id": 15796
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d48250bb",
            "parentcaller": "0x7ff6d48255df",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 15797
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d48237c9",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 15798
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d48237c9",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ShutdownFlyoutOptions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions"
              }
            ],
            "repeated": 0,
            "id": 15799
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d48237c9",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 15800
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15801
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15802
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 15803
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ShutdownFlyoutOptions"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions"
              }
            ],
            "repeated": 0,
            "id": 15804
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 15805
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15806
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15807
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 15808
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ShutdownFlyoutOptions"
              },
              {
                "name": "Data",
                "value": "0"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions"
              }
            ],
            "repeated": 0,
            "id": 15809
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 15810
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4824b85",
            "parentcaller": "0x7ff6d4823293",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 15811
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4824b85",
            "parentcaller": "0x7ff6d4823293",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8A1A8BB1-242F-431A-9F5B-254BA754631C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "42C75F29-D5E0-4DB3-95E1-7494DE083789"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 15812
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d481883f",
            "parentcaller": "0x7ff6d47dbe2a",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              }
            ],
            "repeated": 0,
            "id": 15813
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d48188b1",
            "parentcaller": "0x7ff6d47dbe2a",
            "category": "registry",
            "api": "RegDeleteValueW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "EnhancedShutdownEnabled"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\EnhancedShutdownEnabled"
              }
            ],
            "repeated": 0,
            "id": 15814
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d481890e",
            "parentcaller": "0x7ff6d47dbe2a",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 15815
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d4823533",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15816
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d4823533",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15817
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d4823533",
            "category": "registry",
            "api": "NtCreateKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000484"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000002",
                "pretty_value": "KEY_SET_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator"
              },
              {
                "name": "Class",
                "value": ""
              },
              {
                "name": "Disposition",
                "value": "2",
                "pretty_value": "REG_OPENED_EXISTING_KEY"
              }
            ],
            "repeated": 0,
            "id": 15818
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d4823533",
            "category": "registry",
            "api": "RegSetValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "ShutdownFlyoutOptions"
              },
              {
                "name": "Type",
                "value": "4",
                "pretty_value": "REG_DWORD"
              },
              {
                "name": "Buffer",
                "value": "0"
              },
              {
                "name": "BufferLength",
                "value": "4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions"
              }
            ],
            "repeated": 0,
            "id": 15819
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d4820fcd",
            "parentcaller": "0x7ff6d4823533",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 15820
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 15821
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 15822
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              },
              {
                "name": "ValueName",
                "value": "UsePowerButtonIcon"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\UsePowerButtonIcon"
              }
            ],
            "repeated": 0,
            "id": 15823
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d48183e1",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000484"
              }
            ],
            "repeated": 0,
            "id": 15824
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15825
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15826
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15827
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15828
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15829
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15830
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15831
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15832
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15833
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15834
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 15835
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15836
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15837
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15838
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15839
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 15840
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000474"
              }
            ],
            "repeated": 0,
            "id": 15841
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15842
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15843
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15844
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15845
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15846
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15847
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15848
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15849
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15850
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15851
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 15852
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15853
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15854
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15855
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15856
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 15857
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15858
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15859
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15860
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15861
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15862
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15863
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15864
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15865
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15866
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15867
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15868
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15869
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15870
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15871
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15872
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15873
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15874
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15875
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15876
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15877
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15878
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d484667e",
            "parentcaller": "0x7ff6d4815d47",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "5"
              },
              {
                "name": "InputBuffer",
                "value": ""
              },
              {
                "name": "OutputBuffer",
                "value": "\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 15879
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15880
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15881
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15882
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15883
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15884
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15885
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15886
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15887
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15888
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15889
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 15890
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15891
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15892
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15893
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15894
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 15895
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15896
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15897
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15898
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15899
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15900
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15901
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15902
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15903
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15904
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15905
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15906
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 15907
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15908
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000480"
              }
            ],
            "repeated": 0,
            "id": 15909
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15910
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15911
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 15912
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 15913
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15914
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15915
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15916
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15917
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15918
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15919
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15920
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15921
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15922
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15923
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15924
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15925
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15926
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15927
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15928
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15929
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15930
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15931
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15932
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15933
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15934
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15935
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15936
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15937
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15938
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15939
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15940
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15941
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15942
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15943
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 15944
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15945
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15946
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15947
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15948
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 15949
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15950
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15951
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15952
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15953
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15954
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15955
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15956
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15957
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15958
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15959
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15960
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 15961
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15962
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15963
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15964
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15965
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 15966
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15967
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15968
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15969
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15970
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15971
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 15972
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15973
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 15974
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15975
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15976
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15977
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15978
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15979
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15980
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15981
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15982
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15983
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 15984
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 15985
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 15986
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 15987
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 15988
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 15989
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 15990
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 15991
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15992
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15993
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 15994
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 15995
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 15996
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 15997
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 15998
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 15999
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16000
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16001
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16002
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16003
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16004
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16005
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16006
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16007
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16008
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16009
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16010
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16011
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16012
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16013
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16014
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16015
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16016
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16017
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16018
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16019
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16020
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16021
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16022
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16023
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16024
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16025
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16026
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16027
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 16028
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16029
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16030
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16031
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16032
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16033
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16034
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16035
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16036
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16037
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16038
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16039
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16040
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16041
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16042
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16043
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16044
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16045
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16046
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16047
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16048
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16049
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16050
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16051
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16052
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16053
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16054
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16055
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16056
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16057
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16058
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16059
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16060
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16061
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16062
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16063
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16064
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16065
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16066
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16067
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16068
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16069
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16070
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 16071
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16072
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16073
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16074
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 16075
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16076
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16077
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16078
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16079
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16080
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16081
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 16082
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16083
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16084
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16085
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16086
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16087
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16088
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16089
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16090
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 16091
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16092
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16093
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16094
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 16095
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16096
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16097
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16098
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16099
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16100
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16101
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16102
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16103
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16104
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16105
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16106
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16107
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000488"
              }
            ],
            "repeated": 0,
            "id": 16108
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16109
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16110
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16111
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a8"
              }
            ],
            "repeated": 0,
            "id": 16112
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16113
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16114
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16115
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16116
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16117
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16118
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16119
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16120
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16121
          },
          {
            "timestamp": "2026-05-28 22:32:58,887",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16122
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16123
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16124
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16125
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16126
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16127
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16128
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16129
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16130
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16131
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16132
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16133
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16134
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16135
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 16136
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16137
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16138
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16139
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16140
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16141
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16142
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16143
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16144
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16145
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16146
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16147
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16148
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16149
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16150
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16151
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16152
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16153
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16154
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16155
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16156
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16157
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16158
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16159
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16160
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16161
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16162
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16163
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16164
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16165
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16166
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16167
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16168
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16169
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16170
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16171
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16172
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16173
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16174
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16175
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16176
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16177
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16178
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16179
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16180
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16181
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16182
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16183
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16184
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16185
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16186
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16187
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16188
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16189
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 1,
            "id": 16190
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16191
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16192
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16193
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16194
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16195
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16196
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16197
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16198
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16199
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16200
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16201
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "SetEDURestart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart"
              }
            ],
            "repeated": 0,
            "id": 16202
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483cf90",
            "parentcaller": "0x7ff6d483d2c8",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16203
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16204
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16205
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16206
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16207
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16208
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16209
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16210
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16211
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16212
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16213
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16214
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16215
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16216
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16217
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16218
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursStart"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart"
              }
            ],
            "repeated": 0,
            "id": 16219
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3b0",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16220
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetDllHandle",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              }
            ],
            "repeated": 0,
            "id": 16221
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "system",
            "api": "LdrGetProcedureAddressForCaller",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ModuleName",
                "value": "ntdll.dll"
              },
              {
                "name": "ModuleHandle",
                "value": "0x7fff98c50000"
              },
              {
                "name": "FunctionName",
                "value": "NtQuerySystemInformation"
              },
              {
                "name": "Ordinal",
                "value": "0"
              },
              {
                "name": "FunctionAddress",
                "value": "0x7fff98ced690"
              }
            ],
            "repeated": 0,
            "id": 16222
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "NtQuerySystemInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "SystemInformationClass",
                "value": "134"
              }
            ],
            "repeated": 0,
            "id": 16223
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks"
              }
            ],
            "repeated": 0,
            "id": 16224
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16225
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16226
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate"
              }
            ],
            "repeated": 0,
            "id": 16227
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16228
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16229
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000000"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache"
              }
            ],
            "repeated": 0,
            "id": 16230
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16231
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "Behavior"
              },
              {
                "name": "Data",
                "value": "73760"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior"
              }
            ],
            "repeated": 0,
            "id": 16232
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16233
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              },
              {
                "name": "Handle",
                "value": "0x00000000"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update"
              }
            ],
            "repeated": 0,
            "id": 16234
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus"
              }
            ],
            "repeated": 0,
            "id": 16235
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": false,
            "return": "0x00000002",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "ValueName",
                "value": "ActiveHoursEnd"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd"
              }
            ],
            "repeated": 0,
            "id": 16236
          },
          {
            "timestamp": "2026-05-28 22:32:58,903",
            "thread_id": "12928",
            "caller": "0x7ff6d483d158",
            "parentcaller": "0x7ff6d483d3bf",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16237
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843c61",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\System32\\taskschd"
              },
              {
                "name": "DllBase",
                "value": "0x7fff913d0000"
              }
            ],
            "repeated": 0,
            "id": 16238
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843c61",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\taskschd.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff913d0000"
              }
            ],
            "repeated": 0,
            "id": 16239
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843c61",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16240
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16241
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16242
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16243
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16244
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16245
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16246
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16247
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16248
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16249
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16250
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 2,
            "id": 16251
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 4,
            "id": 16252
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16253
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16254
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 4,
            "id": 16255
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16256
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16257
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16258
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff9146c000"
              },
              {
                "name": "ModuleName",
                "value": "taskschd.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16259
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 19,
            "id": 16260
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee54d000"
              },
              {
                "name": "RegionSize",
                "value": "0x00006000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16261
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 19,
            "id": 16262
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4842faf",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16263
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 1,
            "id": 16264
          },
          {
            "timestamp": "2026-05-28 22:33:01,059",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16265
          },
          {
            "timestamp": "2026-05-28 22:33:02,137",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16266
          },
          {
            "timestamp": "2026-05-28 22:33:02,137",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "system",
            "api": "DllLoadNotification",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "NotificationReason",
                "value": "load"
              },
              {
                "name": "DllName",
                "value": "C:\\Windows\\system32\\WaaSMedicPS"
              },
              {
                "name": "DllBase",
                "value": "0x18ceb640000"
              }
            ],
            "repeated": 0,
            "id": 16267
          },
          {
            "timestamp": "2026-05-28 22:33:02,137",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "system",
            "api": "LdrLoadDll",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Flags",
                "value": "0x00000000"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\WaaSMedicPS.dll"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceb640000"
              }
            ],
            "repeated": 0,
            "id": 16268
          },
          {
            "timestamp": "2026-05-28 22:33:02,137",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9EA82395-E31B-41CA-8DF7-EC1CEE7194DF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "E4DC719B-FE77-414F-9DBE-3E4FFEA7A7A5"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16269
          },
          {
            "timestamp": "2026-05-28 22:33:02,153",
            "thread_id": "12928",
            "caller": "0x7ff6d4843340",
            "parentcaller": "0x7ff6d48445f0",
            "category": "system",
            "api": "NtQuerySystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16270
          },
          {
            "timestamp": "2026-05-28 22:33:02,153",
            "thread_id": "12928",
            "caller": "0x7ff6d4843340",
            "parentcaller": "0x7ff6d48445f0",
            "category": "process",
            "api": "NtQueryInformationToken",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "TokenInformationClass",
                "value": "29"
              },
              {
                "name": "TokenInformation",
                "value": "\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16271
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d4844610",
            "parentcaller": "0x7ff6d47d2c4d",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 16272
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843c61",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16273
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16274
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16275
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16276
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16277
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16278
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16279
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16280
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 2,
            "id": 16281
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 41,
            "id": 16282
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4842faf",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16283
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16284
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16285
          },
          {
            "timestamp": "2026-05-28 22:33:02,168",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16286
          },
          {
            "timestamp": "2026-05-28 22:33:02,184",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16287
          },
          {
            "timestamp": "2026-05-28 22:33:02,184",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9EA82395-E31B-41CA-8DF7-EC1CEE7194DF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "E4DC719B-FE77-414F-9DBE-3E4FFEA7A7A5"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16288
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d484469b",
            "parentcaller": "0x7ff6d47d2c4d",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 16289
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843c61",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16290
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16291
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16292
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843c61",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16293
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16294
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16295
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16296
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4843a3e",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16297
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 2,
            "id": 16298
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d4843b1e",
            "parentcaller": "0x7ff6d4843de7",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 41,
            "id": 16299
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48425e6",
            "parentcaller": "0x7ff6d4842faf",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "0F87369F-A4E5-4CFC-BD3E-73E6154572DD"
              },
              {
                "name": "ClsContext",
                "value": "0x00000001",
                "pretty_value": "CLSCTX_INPROC_SERVER"
              },
              {
                "name": "riid",
                "value": "2FABA4C7-4DA9-4013-9697-20CC3FD40F85"
              },
              {
                "name": "ProgID",
                "value": "Schedule.Service.1"
              }
            ],
            "repeated": 0,
            "id": 16300
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\t\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16301
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "0",
                "pretty_value": "ThreadBasicInformation"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x03\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xf0\\xea\\xa3?\\x00\\x00\\x00`\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x802\\x00\\x00\\x00\\x00\\x00\\x00?\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16302
          },
          {
            "timestamp": "2026-05-28 22:33:02,200",
            "thread_id": "12928",
            "caller": "0x7ff6d48426b7",
            "parentcaller": "0x7ff6d4842faf",
            "category": "misc",
            "api": "GetComputerNameW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "ComputerName",
                "value": "JOHNS-PC"
              }
            ],
            "repeated": 0,
            "id": 16303
          },
          {
            "timestamp": "2026-05-28 22:33:02,215",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16304
          },
          {
            "timestamp": "2026-05-28 22:33:02,215",
            "thread_id": "12928",
            "caller": "0x7ff6d4844a0d",
            "parentcaller": "0x7ff6d48432ae",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "9EA82395-E31B-41CA-8DF7-EC1CEE7194DF"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "E4DC719B-FE77-414F-9DBE-3E4FFEA7A7A5"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16305
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844704",
            "parentcaller": "0x7ff6d47d2c4d",
            "category": "system",
            "api": "GetUserDefaultLCID",
            "status": true,
            "return": "0x00000c09",
            "arguments": [
              {
                "name": "SystemDefaultLangID",
                "value": "0x00000c09"
              },
              {
                "name": "LanguageName",
                "value": "English (Australia)"
              }
            ],
            "repeated": 0,
            "id": 16306
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4824b85",
            "parentcaller": "0x7ff6d484490e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "00000339-0000-0000-C000-000000000046"
              },
              {
                "name": "ClsContext",
                "value": "0x00000403",
                "pretty_value": "CLSCTX_INPROC_SERVER|CLSCTX_INPROC_HANDLER|CLSCTX_NO_CODE_DOWNLOAD"
              },
              {
                "name": "riid",
                "value": "00000003-0000-0000-C000-000000000046"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16307
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4824b85",
            "parentcaller": "0x7ff6d484490e",
            "category": "com",
            "api": "CoCreateInstance",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "rclsid",
                "value": "8A1A8BB1-242F-431A-9F5B-254BA754631C"
              },
              {
                "name": "ClsContext",
                "value": "0x00000004",
                "pretty_value": "CLSCTX_LOCAL_SERVER"
              },
              {
                "name": "riid",
                "value": "42C75F29-D5E0-4DB3-95E1-7494DE083789"
              },
              {
                "name": "ProgID",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16308
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844932",
            "parentcaller": "0x7ff6d47cf065",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000002c4"
              },
              {
                "name": "SubKey",
                "value": "Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}"
              },
              {
                "name": "Handle",
                "value": "0x000004ac"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}"
              }
            ],
            "repeated": 0,
            "id": 16309
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844932",
            "parentcaller": "0x7ff6d47cf065",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x000004ac"
              },
              {
                "name": "SubKey",
                "value": "ProxyStubClsid32"
              },
              {
                "name": "Handle",
                "value": "0x000004b4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}\\ProxyStubClsid32"
              }
            ],
            "repeated": 0,
            "id": 16310
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844932",
            "parentcaller": "0x7ff6d47cf065",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004b4"
              },
              {
                "name": "ValueName",
                "value": ""
              },
              {
                "name": "Data",
                "value": "{607C052E-2B08-4548-BD1D-EB7665A34788}"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}\\ProxyStubClsid32\\(Default)"
              }
            ],
            "repeated": 0,
            "id": 16311
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844932",
            "parentcaller": "0x7ff6d47cf065",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004b4"
              }
            ],
            "repeated": 0,
            "id": 16312
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844932",
            "parentcaller": "0x7ff6d47cf065",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004ac"
              }
            ],
            "repeated": 0,
            "id": 16313
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844932",
            "parentcaller": "0x7ff6d47cf065",
            "category": "system",
            "api": "GetSystemTimeAsFileTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16314
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4844932",
            "parentcaller": "0x7ff6d47cf065",
            "category": "system",
            "api": "NtWaitForSingleObject",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000002b8"
              },
              {
                "name": "Milliseconds",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16315
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16316
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16317
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4868518",
            "parentcaller": "0x7ff6d47f23d9",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16318
          },
          {
            "timestamp": "2026-05-28 22:33:02,231",
            "thread_id": "12928",
            "caller": "0x7ff6d4846347",
            "parentcaller": "0x7ff6d47dc135",
            "category": "device",
            "api": "NtPowerInformation",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "InformationLevel",
                "value": "44"
              },
              {
                "name": "InputBuffer",
                "value": "\\x10\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "OutputBuffer",
                "value": ""
              }
            ],
            "repeated": 0,
            "id": 16319
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "12928",
            "caller": "0x7ff6d47f5dc3",
            "parentcaller": "0x7ff6d47f5181",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000404"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadbf3e0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "13048"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "Module",
                "value": "ucrtbase.dll"
              }
            ],
            "repeated": 0,
            "id": 16320
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "12928",
            "caller": "0x7ff6d47f5dc3",
            "parentcaller": "0x7ff6d47f5181",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000404",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadbf3e0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "13048"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              }
            ],
            "repeated": 0,
            "id": 16321
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16322
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadbf3e0"
              }
            ],
            "repeated": 0,
            "id": 16323
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "12928",
            "caller": "0x7ff6d47f5dc3",
            "parentcaller": "0x7ff6d47f5260",
            "category": "threading",
            "api": "NtCreateThreadEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000404"
              },
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartAddress",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadbf4d0"
              },
              {
                "name": "CreateFlags",
                "value": "0x00000001"
              },
              {
                "name": "ThreadId",
                "value": "13044"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              },
              {
                "name": "Module",
                "value": "ucrtbase.dll"
              }
            ],
            "repeated": 0,
            "id": 16324
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "12928",
            "caller": "0x7ff6d47f5dc3",
            "parentcaller": "0x7ff6d47f5260",
            "category": "threading",
            "api": "CreateRemoteThreadEx",
            "status": true,
            "return": "0x00000404",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "StartRoutine",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadbf4d0"
              },
              {
                "name": "CreationFlags",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "13044"
              },
              {
                "name": "ProcessId",
                "value": "8032"
              }
            ],
            "repeated": 0,
            "id": 16325
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "12928",
            "caller": "0x7fff98ca467e",
            "parentcaller": "0x7fff9654f79a",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "12928"
              }
            ],
            "repeated": 0,
            "id": 16326
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cefb7c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00005000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16327
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced098000"
              },
              {
                "name": "RegionSize",
                "value": "0x00007000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16328
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "12928",
            "caller": "0x7fff98c97830",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff986c1000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16329
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "12928",
            "caller": "0x7fff98c97881",
            "parentcaller": "0x7fff98c820f9",
            "category": "process",
            "api": "NtProtectVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x7fff986c1000"
              },
              {
                "name": "ModuleName",
                "value": "ole32.dll"
              },
              {
                "name": "NumberOfBytesProtected",
                "value": "0x00001000"
              },
              {
                "name": "MemoryType",
                "value": "0x00000000"
              },
              {
                "name": "NewAccessProtection",
                "value": "0x00000002",
                "pretty_value": "PAGE_READONLY"
              },
              {
                "name": "OldAccessProtection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16330
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16331
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16332
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\n\\x00\\x00\\x00\\x07\r9\\x00\r9\\x0f+\\x0f\\x96\r\\xee\r\\x87\\x0e\\xc0\\x0eU\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "20480"
              }
            ],
            "repeated": 0,
            "id": 16333
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16334
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16335
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "system",
            "api": "GetSystemTime",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16336
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00?z1\\xa0\\x00\\x00\\x07\\xc3\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "512"
              }
            ],
            "repeated": 0,
            "id": 16337
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xf4"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16338
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13044",
            "caller": "0x7fff98cc507d",
            "parentcaller": "0x7fff98cc4c43",
            "category": "threading",
            "api": "NtTestAlert",
            "status": true,
            "return": "0x00000000",
            "arguments": [],
            "repeated": 0,
            "id": 16339
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13044",
            "caller": "0x00000000",
            "parentcaller": "0x00000000",
            "category": "threading",
            "api": "RtlUserThreadStart",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "StartAddress",
                "value": "0x7fff96351b70"
              },
              {
                "name": "Parameter",
                "value": "0x18ceadbf4d0"
              }
            ],
            "repeated": 0,
            "id": 16340
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13044",
            "caller": "0x7fff98ca467e",
            "parentcaller": "0x7fff9654f79a",
            "category": "threading",
            "api": "NtQueryInformationThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0xfffffffe"
              },
              {
                "name": "ThreadInformationClass",
                "value": "12"
              },
              {
                "name": "ThreadInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "ThreadId",
                "value": "13044"
              }
            ],
            "repeated": 0,
            "id": 16341
          },
          {
            "timestamp": "2026-05-28 22:33:02,247",
            "thread_id": "13044",
            "caller": "0x7fff98ca469e",
            "parentcaller": "0x7fff9654f79a",
            "category": "threading",
            "api": "NtTerminateThread",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ThreadHandle",
                "value": "0x00000000"
              },
              {
                "name": "ExitStatus",
                "value": "0x00000000"
              },
              {
                "name": "ThreadId",
                "value": "0"
              },
              {
                "name": "ProcessId",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16342
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00$\\x00\\x00\\x007\\x002\\x00e\\x007\\x006\\x002\\x004\\x00a\\x00-\\x005\\x00b\\x000\\x000\\x00-\\x004\\x005\\x00d\\x002\\x00-\\x00b\\x009\\x002\\x00f\\x00-\\x00e\\x005\\x006\\x001\\x00c\\x000\\x00a\\x006\\x00a\\x001\\x006\\x000\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x008\\x00.\\x001\\x00 \\x00a\\x00n\\x00d\\x00 \\x00l\\x00a\\x00t\\x00e\\x00r\\x00 \\x00d\\x00r\\x00i\\x00v\\x00e\\x00r\\x00s\\x00\\x00\\x00$"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16343
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "?z3\\xcb"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16344
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x01"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16345
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xe7\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe7\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16346
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "?z3\\xdf"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16347
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": false,
            "return": "0xffffffffc0000011",
            "pretty_return": "END_OF_FILE",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ""
              },
              {
                "name": "Length",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16348
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004b4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\xd5\\x05\\xf9 \\xa1c\\xd7\\x00\\x00\\x00\\x02"
              },
              {
                "name": "Length",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 16349
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xe8\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16350
          },
          {
            "timestamp": "2026-05-28 22:33:02,262",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00$\\x00\\x00\\x007\\x002\\x00e\\x007\\x006\\x002\\x004\\x00a\\x00-\\x005\\x00b\\x000\\x000\\x00-\\x004\\x005\\x00d\\x002\\x00-\\x00b\\x009\\x002\\x00f\\x00-\\x00e\\x005\\x006\\x001\\x00c\\x000\\x00a\\x006\\x00a\\x001\\x006\\x000\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x008\\x00.\\x001\\x00 \\x00a\\x00n\\x00d\\x00 \\x00l\\x00a\\x00t\\x00e\\x00r\\x00 \\x00d\\x00r\\x00i\\x00v\\x00e\\x00r\\x00s\\x00\\x00\\x00$"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16351
          },
          {
            "timestamp": "2026-05-28 22:33:02,278",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16352
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "DeleteFileW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16353
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16354
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16355
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16356
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16357
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x00000338"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16358
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16359
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 16360
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16361
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16362
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000338"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16363
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16364
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 16365
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16366
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16367
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x00000338"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16368
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16369
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x00000338"
              }
            ],
            "repeated": 0,
            "id": 16370
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16371
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16372
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16373
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16374
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16375
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\r\\x00\\x00\\x00\\x01\\x05\\x05\\x00\\x05\\x05\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 16376
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16377
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16378
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00:\\x99z\\x0b\\x00\\x00\\x07\\xc3\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "512"
              }
            ],
            "repeated": 0,
            "id": 16379
          },
          {
            "timestamp": "2026-05-28 22:33:02,293",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x1c"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16380
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00$\\x00\\x00\\x007\\x002\\x00e\\x007\\x006\\x002\\x004\\x00a\\x00-\\x005\\x00b\\x000\\x000\\x00-\\x004\\x005\\x00d\\x002\\x00-\\x00b\\x009\\x002\\x00f\\x00-\\x00e\\x005\\x006\\x001\\x00c\\x000\\x00a\\x006\\x00a\\x001\\x006\\x000\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x008\\x00.\\x001\\x00 \\x00a\\x00n\\x00d\\x00 \\x00l\\x00a\\x00t\\x00e\\x00r\\x00 \\x00d\\x00r\\x00i\\x00v\\x00e\\x00r\\x00s\\x00\\x00\\x00$\\x00\\x00\\x004\\x000\\x005\\x007\\x000\\x006\\x00e\\x00d\\x00-\\x00f\\x001\\x00d"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16381
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ":\\x99{\\x84"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16382
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x01"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16383
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xe8\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe8\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16384
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ":\\x99|J"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16385
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": false,
            "return": "0xffffffffc0000011",
            "pretty_return": "END_OF_FILE",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ""
              },
              {
                "name": "Length",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16386
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000338"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\xd5\\x05\\xf9 \\xa1c\\xd7\\x00\\x00\\x00\\x02"
              },
              {
                "name": "Length",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 16387
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xe9\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe9\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16388
          },
          {
            "timestamp": "2026-05-28 22:33:02,309",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00$\\x00\\x00\\x007\\x002\\x00e\\x007\\x006\\x002\\x004\\x00a\\x00-\\x005\\x00b\\x000\\x000\\x00-\\x004\\x005\\x00d\\x002\\x00-\\x00b\\x009\\x002\\x00f\\x00-\\x00e\\x005\\x006\\x001\\x00c\\x000\\x00a\\x006\\x00a\\x001\\x006\\x000\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x008\\x00.\\x001\\x00 \\x00a\\x00n\\x00d\\x00 \\x00l\\x00a\\x00t\\x00e\\x00r\\x00 \\x00d\\x00r\\x00i\\x00v\\x00e\\x00r\\x00s\\x00\\x00\\x00$\\x00\\x00\\x004\\x000\\x005\\x007\\x000\\x006\\x00e\\x00d\\x00-\\x00f\\x001\\x00d"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16389
          },
          {
            "timestamp": "2026-05-28 22:33:02,325",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16390
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "DeleteFileW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16391
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16392
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16393
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16394
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16395
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16396
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16397
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16398
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16399
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16400
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16401
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16402
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16403
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16404
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16405
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16406
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16407
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16408
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16409
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16410
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16411
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16412
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16413
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\r\\x00\\x00\\x00\\x01\\x02'\\x00\\x02'\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 16414
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16415
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16416
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x19\\x90m~\\x00\\x00\\x07\\xc3\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "512"
              }
            ],
            "repeated": 0,
            "id": 16417
          },
          {
            "timestamp": "2026-05-28 22:33:02,340",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x10"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16418
          },
          {
            "timestamp": "2026-05-28 22:33:02,356",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\xff\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00$\\x00\\x00\\x007\\x002\\x00e\\x007\\x006\\x002\\x004\\x00a\\x00-\\x005\\x00b\\x000\\x000\\x00-\\x004\\x005\\x00d\\x002\\x00-\\x00b\\x009\\x002\\x00f\\x00-\\x00e\\x005\\x006\\x001\\x00c\\x000\\x00a\\x006\\x00a\\x001\\x006\\x000\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x008\\x00.\\x001\\x00 \\x00a\\x00n\\x00d\\x00 \\x00l\\x00a\\x00t\\x00e\\x00r\\x00 \\x00d\\x00r\\x00i\\x00v\\x00e\\x00r\\x00s\\x00\\x00\\x00$\\x00\\x00\\x004\\x000\\x005\\x007\\x000\\x006\\x00e\\x00d\\x00-\\x00f\\x001"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16419
          },
          {
            "timestamp": "2026-05-28 22:33:02,356",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x19\\x90o%"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16420
          },
          {
            "timestamp": "2026-05-28 22:33:02,356",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x01"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16421
          },
          {
            "timestamp": "2026-05-28 22:33:02,356",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xe9\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xe9\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16422
          },
          {
            "timestamp": "2026-05-28 22:33:02,356",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x19\\x90o\\xbd"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16423
          },
          {
            "timestamp": "2026-05-28 22:33:02,356",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": false,
            "return": "0xffffffffc0000011",
            "pretty_return": "END_OF_FILE",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ""
              },
              {
                "name": "Length",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16424
          },
          {
            "timestamp": "2026-05-28 22:33:02,356",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\xd5\\x05\\xf9 \\xa1c\\xd7\\x00\\x00\\x00\\x02"
              },
              {
                "name": "Length",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 16425
          },
          {
            "timestamp": "2026-05-28 22:33:02,372",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xea\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xea\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16426
          },
          {
            "timestamp": "2026-05-28 22:33:02,372",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\xff\\x00\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00$\\x00\\x00\\x007\\x002\\x00e\\x007\\x006\\x002\\x004\\x00a\\x00-\\x005\\x00b\\x000\\x000\\x00-\\x004\\x005\\x00d\\x002\\x00-\\x00b\\x009\\x002\\x00f\\x00-\\x00e\\x005\\x006\\x001\\x00c\\x000\\x00a\\x006\\x00a\\x001\\x006\\x000\\x00\\x00\\x00\n\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x001\\x001\\x00\\x00\\x00\\x07\\x00\\x00\\x00P\\x00r\\x00o\\x00d\\x00u\\x00c\\x00t\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x1d\\x00\\x00\\x00W\\x00i\\x00n\\x00d\\x00o\\x00w\\x00s\\x00 \\x008\\x00.\\x001\\x00 \\x00a\\x00n\\x00d\\x00 \\x00l\\x00a\\x00t\\x00e\\x00r\\x00 \\x00d\\x00r\\x00i\\x00v\\x00e\\x00r\\x00s\\x00\\x00\\x00$\\x00\\x00\\x004\\x000\\x005\\x007\\x000\\x006\\x00e\\x00d\\x00-\\x00f\\x001"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16427
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16428
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "DeleteFileW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16429
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16430
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16431
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16432
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16433
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16434
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16435
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16436
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16437
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16438
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16439
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16440
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16441
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16442
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16443
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16444
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16445
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16446
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16447
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16448
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16449
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16450
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16451
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16452
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\r\\x00\\x00\\x00\\x01\\x01\\x89\\x00\\x01\\x89\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "16384"
              }
            ],
            "repeated": 0,
            "id": 16453
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16454
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16455
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x8d\\x10\\x90\\x9c\\x00\\x00\\x07\\xc3\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "512"
              }
            ],
            "repeated": 0,
            "id": 16456
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xf2"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16457
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00s\\x00i\\x00d\\x00e\\x00r\\x00 \\x00P\\x00r\\x00e\\x00-\\x00R\\x00e\\x00l\\x00e\\x00a\\x00s\\x00e\\x00\\x00\\x00$\\x00\\x00\\x00c\\x00a\\x000\\x000\\x006\\x00c\\x00f\\x00b\\x00-\\x004\\x009\\x00e\\x00b\\x00-\\x004\\x003\\x009\\x00b\\x00-\\x008\\x008\\x000\\x00a\\x00-\\x001\\x003\\x001\\x002\\x00e\\x001\\x00f\\x00c\\x009\\x007\\x001\\x003\\x00\\x00\\x00{\\x00\\x00\\x00T\\x00h\\x00i\\x00s\\x00 \\x00n\\x00e\\x00w\\x00 \\x00c\\x00a\\x00t\\x00e\\x00g\\x00o\\x00r\\x00y\\x00 \\x00w\\x00i\\x00l\\x00l\\x00 \\x00b\\x00e\\x00 \\x00u\\x00s\\x00e\\x00d\\x00 \\x00f\\x00o\\x00r\\x00 \\x00a\\x00l\\x00l\\x00 \\x00f\\x00u\\x00t\\x00u\\x00r\\x00e\\x00 \\x00p\\x00r\\x00e\\x00-\\x00r\\x00e\\x00l\\x00e\\x00a\\x00s\\x00e\\x00 \\x00f\\x00e\\x00a\\x00t\\x00u\\x00r\\x00e"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16458
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x8d\\x10\\x92d"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16459
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x01"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16460
          },
          {
            "timestamp": "2026-05-28 22:33:02,387",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xea\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xea\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16461
          },
          {
            "timestamp": "2026-05-28 22:33:02,403",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x8d\\x10\\x92\\xdb"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16462
          },
          {
            "timestamp": "2026-05-28 22:33:02,403",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": false,
            "return": "0xffffffffc0000011",
            "pretty_return": "END_OF_FILE",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ""
              },
              {
                "name": "Length",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16463
          },
          {
            "timestamp": "2026-05-28 22:33:02,403",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\xd5\\x05\\xf9 \\xa1c\\xd7\\x00\\x00\\x00\\x02"
              },
              {
                "name": "Length",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 16464
          },
          {
            "timestamp": "2026-05-28 22:33:02,403",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xeb\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16465
          },
          {
            "timestamp": "2026-05-28 22:33:02,403",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00I\\x00n\\x00s\\x00i\\x00d\\x00e\\x00r\\x00 \\x00P\\x00r\\x00e\\x00-\\x00R\\x00e\\x00l\\x00e\\x00a\\x00s\\x00e\\x00\\x00\\x00$\\x00\\x00\\x00c\\x00a\\x000\\x000\\x006\\x00c\\x00f\\x00b\\x00-\\x004\\x009\\x00e\\x00b\\x00-\\x004\\x003\\x009\\x00b\\x00-\\x008\\x008\\x000\\x00a\\x00-\\x001\\x003\\x001\\x002\\x00e\\x001\\x00f\\x00c\\x009\\x007\\x001\\x003\\x00\\x00\\x00{\\x00\\x00\\x00T\\x00h\\x00i\\x00s\\x00 \\x00n\\x00e\\x00w\\x00 \\x00c\\x00a\\x00t\\x00e\\x00g\\x00o\\x00r\\x00y\\x00 \\x00w\\x00i\\x00l\\x00l\\x00 \\x00b\\x00e\\x00 \\x00u\\x00s\\x00e\\x00d\\x00 \\x00f\\x00o\\x00r\\x00 \\x00a\\x00l\\x00l\\x00 \\x00f\\x00u\\x00t\\x00u\\x00r\\x00e\\x00 \\x00p\\x00r\\x00e\\x00-\\x00r\\x00e\\x00l\\x00e\\x00a\\x00s\\x00e\\x00 \\x00f\\x00e\\x00a\\x00t\\x00u\\x00r\\x00e"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16466
          },
          {
            "timestamp": "2026-05-28 22:33:02,403",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16467
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "DeleteFileW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16468
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16469
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16470
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16471
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16472
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16473
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16474
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16475
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16476
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16477
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16478
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16479
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16480
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16481
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16482
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16483
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16484
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16485
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16486
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16487
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16488
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16489
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16490
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16491
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16492
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16493
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xcb\\xa8\\xb4\\xeb\\x00\\x00\\x07\\xc3\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "512"
              }
            ],
            "repeated": 0,
            "id": 16494
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x19"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16495
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00u\\x00d\\x00e\\x00d\\x00 \\x00i\\x00n\\x00 \\x00t\\x00h\\x00i\\x00s\\x00 \\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00,\\x00 \\x00s\\x00e\\x00e\\x00 \\x00t\\x00h\\x00e\\x00 \\x00a\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00e\\x00d\\x00 \\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00K\\x00n\\x00o\\x00w\\x00l\\x00e\\x00d\\x00g\\x00e\\x00 \\x00B\\x00a\\x00s\\x00e\\x00 \\x00a\\x00r\\x00t\\x00i\\x00c\\x00l\\x00e\\x00.\\x00 \\x00A\\x00f\\x00t\\x00e\\x00r\\x00 \\x00y\\x00o\\x00u\\x00 \\x00i\\x00n\\x00s\\x00t\\x00a\\x00l\\x00l\\x00 \\x00t\\x00h\\x00i\\x00s\\x00 \\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00,\\x00 \\x00y\\x00o\\x00u\\x00 \\x00m\\x00a\\x00y\\x00 \\x00h\\x00a\\x00v\\x00e\\x00 \\x00t\\x00o\\x00 \\x00r\\x00e\\x00s\\x00t\\x00a\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16496
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xcb\\xa8\\xbcd"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16497
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x01"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16498
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xeb\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xeb\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16499
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xcb\\xa8\\xb7*"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16500
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": false,
            "return": "0xffffffffc0000011",
            "pretty_return": "END_OF_FILE",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ""
              },
              {
                "name": "Length",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16501
          },
          {
            "timestamp": "2026-05-28 22:33:02,418",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000004a4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\xd5\\x05\\xf9 \\xa1c\\xd7\\x00\\x00\\x00\\x02"
              },
              {
                "name": "Length",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 16502
          },
          {
            "timestamp": "2026-05-28 22:33:02,434",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xec\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xec\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16503
          },
          {
            "timestamp": "2026-05-28 22:33:02,434",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00u\\x00d\\x00e\\x00d\\x00 \\x00i\\x00n\\x00 \\x00t\\x00h\\x00i\\x00s\\x00 \\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00,\\x00 \\x00s\\x00e\\x00e\\x00 \\x00t\\x00h\\x00e\\x00 \\x00a\\x00s\\x00s\\x00o\\x00c\\x00i\\x00a\\x00t\\x00e\\x00d\\x00 \\x00M\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00 \\x00K\\x00n\\x00o\\x00w\\x00l\\x00e\\x00d\\x00g\\x00e\\x00 \\x00B\\x00a\\x00s\\x00e\\x00 \\x00a\\x00r\\x00t\\x00i\\x00c\\x00l\\x00e\\x00.\\x00 \\x00A\\x00f\\x00t\\x00e\\x00r\\x00 \\x00y\\x00o\\x00u\\x00 \\x00i\\x00n\\x00s\\x00t\\x00a\\x00l\\x00l\\x00 \\x00t\\x00h\\x00i\\x00s\\x00 \\x00u\\x00p\\x00d\\x00a\\x00t\\x00e\\x00,\\x00 \\x00y\\x00o\\x00u\\x00 \\x00m\\x00a\\x00y\\x00 \\x00h\\x00a\\x00v\\x00e\\x00 \\x00t\\x00o\\x00 \\x00r\\x00e\\x00s\\x00t\\x00a\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16504
          },
          {
            "timestamp": "2026-05-28 22:33:02,434",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16505
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "DeleteFileW",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16506
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16507
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16508
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47ee1c1",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16509
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d484156d",
            "parentcaller": "0x7ff6d4840aa5",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x18cead60fe0"
              },
              {
                "name": "DesiredAccess",
                "value": "0x80100080",
                "pretty_value": "GENERIC_READ|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\Windows\\System32\\UsoSelfhost.dll"
              },
              {
                "name": "CreateDisposition",
                "value": "1",
                "pretty_value": "FILE_OPEN"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16510
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d48183c4",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegOpenKeyExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Registry",
                "value": "0x80000002",
                "pretty_value": "HKEY_LOCAL_MACHINE"
              },
              {
                "name": "SubKey",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16511
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d481845a",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16512
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d48184b8",
            "parentcaller": "0x7ff6d4819424",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16513
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16514
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16515
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16516
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16517
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820c3b",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16518
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "misc",
            "api": "RtlSetCurrentTransaction",
            "status": true,
            "return": "0x00000001",
            "arguments": [
              {
                "name": "TransactionHandle",
                "value": "0x00000000"
              }
            ],
            "repeated": 1,
            "id": 16519
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtQueryKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000000d8"
              },
              {
                "name": "KeyInformation",
                "value": "\\x00\\x00\\x00\\x00"
              },
              {
                "name": "KeyInformationClass",
                "value": "7"
              }
            ],
            "repeated": 0,
            "id": 16520
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "NtOpenKeyEx",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "KeyHandle",
                "value": "0x000004a4"
              },
              {
                "name": "DesiredAccess",
                "value": "0x00000001",
                "pretty_value": "KEY_QUERY_VALUE"
              },
              {
                "name": "ObjectAttributesHandle",
                "value": "0x000000d8"
              },
              {
                "name": "ObjectAttributesName",
                "value": "Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              },
              {
                "name": "ObjectAttributes",
                "value": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings"
              }
            ],
            "repeated": 0,
            "id": 16521
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegQueryValueExW",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              },
              {
                "name": "ValueName",
                "value": "WuDefaultSlaInMinutes"
              },
              {
                "name": "Data",
                "value": "2880"
              },
              {
                "name": "FullName",
                "value": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes"
              }
            ],
            "repeated": 0,
            "id": 16522
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4820cda",
            "parentcaller": "0x7ff6d4818608",
            "category": "registry",
            "api": "RegCloseKey",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "Handle",
                "value": "0x000004a4"
              }
            ],
            "repeated": 0,
            "id": 16523
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16524
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16525
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d4867dad",
            "parentcaller": "0x7ff6d47f1340",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16526
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0a0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00016000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16527
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cee9f4000"
              },
              {
                "name": "RegionSize",
                "value": "0x00054000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16528
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cef493000"
              },
              {
                "name": "RegionSize",
                "value": "0x00085000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16529
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00111000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16530
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00004000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16531
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced200000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16532
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced210000"
              },
              {
                "name": "RegionSize",
                "value": "0x00224000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16533
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced210000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000c000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16534
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced433000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16535
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00111000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 16536
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x0043d000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16537
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16538
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18cedc4c000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16539
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced210000"
              },
              {
                "name": "RegionSize",
                "value": "0x00224000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 16540
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e0000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16541
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000e000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16542
          },
          {
            "timestamp": "2026-05-28 22:33:02,450",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4cf000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16543
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003dd000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16544
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16545
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceefac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16546
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003e0000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 16547
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d488b772",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x0043d000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 16548
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d486b2a0",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003db000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16549
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d486b2a0",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x00009000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16550
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d486b2a0",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4ca000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16551
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d488b7e0",
            "parentcaller": "0x7ff6d48833ae",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003dd000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 16552
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d48705a3",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x005c9000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16553
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d48705a3",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced810000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000f000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16554
          },
          {
            "timestamp": "2026-05-28 22:33:02,465",
            "thread_id": "13048",
            "caller": "0x7ff6d48d004b",
            "parentcaller": "0x7ff6d48705a3",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceddd8000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16555
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4826b09",
            "parentcaller": "0x7ff6d4870629",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003db000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 16556
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866ae5",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003df000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16557
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866ae5",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced0f0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000d000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16558
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866ae5",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ced4ce000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16559
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16560
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal"
              }
            ],
            "repeated": 0,
            "id": 16561
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryInformationFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "FileInformationClass",
                "value": "5",
                "pretty_value": "FileStandardInformation"
              },
              {
                "name": "FileInformation",
                "value": "\\x000|\\x00\\x00\\x00\\x00\\x00\\x000|\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              }
            ],
            "repeated": 0,
            "id": 16562
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "process",
            "api": "NtAllocateVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003dd000"
              },
              {
                "name": "Protection",
                "value": "0x00000004",
                "pretty_value": "PAGE_READWRITE"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16563
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x0000b000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16564
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceefac000"
              },
              {
                "name": "RegionSize",
                "value": "0x00001000"
              },
              {
                "name": "FreeType",
                "value": "0x00004000"
              }
            ],
            "repeated": 0,
            "id": 16565
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryFullAttributesFile",
            "status": false,
            "return": "0xffffffffc0000034",
            "pretty_return": "OBJECT_NAME_NOT_FOUND",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16566
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtCreateFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "DesiredAccess",
                "value": "0xc0100080",
                "pretty_value": "GENERIC_READ|GENERIC_WRITE|FILE_READ_ATTRIBUTES|SYNCHRONIZE"
              },
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "CreateDisposition",
                "value": "3",
                "pretty_value": "FILE_OPEN_IF"
              },
              {
                "name": "ShareAccess",
                "value": "3",
                "pretty_value": "FILE_SHARE_READ|FILE_SHARE_WRITE"
              },
              {
                "name": "FileAttributes",
                "value": "0x00000080",
                "pretty_value": "FILE_ATTRIBUTE_NORMAL"
              },
              {
                "name": "ExistedBefore",
                "value": "no"
              },
              {
                "name": "StackPivoted",
                "value": "no"
              }
            ],
            "repeated": 0,
            "id": 16567
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xd7\\x1a\\x1a\\xf6\\x00\\x00\\x07\\xc3\\x00\\x00\\x02\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "512"
              }
            ],
            "repeated": 0,
            "id": 16568
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x1a"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16569
          },
          {
            "timestamp": "2026-05-28 22:33:02,481",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x18-\\x00s\\x00p\\x00e\\x00c\\x00i\\x00f\\x00i\\x00c\\x00 \\x00s\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00-\\x00r\\x00e\\x00l\\x00a\\x00t\\x00e\\x00d\\x00 \\x00v\\x00u\\x00l\\x00n\\x00e\\x00r\\x00a\\x00b\\x00i\\x00l\\x00i\\x00t\\x00y\\x00.\\x00 \\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00 \\x00v\\x00u\\x00l\\x00n\\x00e\\x00r\\x00a\\x00b\\x00i\\x00l\\x00i\\x00t\\x00i\\x00e\\x00s\\x00 \\x00a\\x00r\\x00e\\x00 \\x00r\\x00a\\x00t\\x00e\\x00d\\x00 \\x00b\\x00a\\x00s\\x00e\\x00d\\x00 \\x00o\\x00n\\x00 \\x00t\\x00h\\x00e\\x00i\\x00r\\x00 \\x00s\\x00e\\x00v\\x00e\\x00r\\x00i\\x00t\\x00y\\x00 \\x00w\\x00h\\x00i\\x00c\\x00h\\x00 \\x00i\\x00s\\x00 \\x00i\\x00n\\x00d\\x00i\\x00c\\x00a\\x00t\\x00e\\x00d\\x00 \\x00i\\x00n\\x00 \\x00t\\x00h\\x00e\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16570
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x03\\xf57\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00k\\x002\\x00O\\x009\\x00u\\x00P\\x00x\\x00N\\x00m\\x00w\\x00s\\x00R\\x00I\\x00A\\x00S\\x00b\\x00L\\x00M\\x00B\\x00U\\x000\\x00C\\x00I\\x008\\x00H\\x004\\x00L\\x00O\\x001\\x00r\\x00v\\x00X\\x00g\\x00B\\x00z\\x00E\\x00x\\x00h\\x00V\\x00c\\x002\\x00h\\x00R\\x00h\\x00v\\x005\\x00P\\x00C\\x00I\\x00%\\x002\\x00b\\x00T\\x00F\\x006\\x00u\\x009\\x00c\\x00R\\x00I\\x00C\\x00y\\x009\\x00t\\x00m\\x00l\\x00u\\x00w\\x00R\\x00l\\x00K\\x00t\\x00D\\x001\\x003\\x00r\\x00G\\x00z\\x008\\x00o\\x00j\\x00Q\\x00w\\x003\\x00B\\x00H\\x00L\\x00w\\x00%\\x003\\x00d\\x00%\\x003\\x00d\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\xe7\\x00\\x00\\x00h\\x00t\\x00t\\x00p\\x00:\\x00/\\x00/\\x00t\\x00l\\x00u\\x00"
              },
              {
                "name": "Length",
                "value": "3997696"
              }
            ],
            "repeated": 0,
            "id": 16571
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x07\\xc3"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16572
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00c\\x00e\\x00a\\x00b\\x001\\x002\\x00d\\x00c\\x00-\\x003\\x002\\x00f\\x00a\\x00-\\x004\\x007\\x005\\x002\\x00-\\x00b\\x00e\\x009\\x002\\x00-\\x002\\x005\\x009\\x00e\\x004\\x00e\\x009\\x009\\x001\\x000\\x009\\x00e\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00O\\x00z\\x009\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16573
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd7\\x1a\\x1f\\xf9"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16574
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "process",
            "api": "NtFreeVirtualMemory",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "ProcessHandle",
                "value": "0xffffffff"
              },
              {
                "name": "BaseAddress",
                "value": "0x18ceebd0000"
              },
              {
                "name": "RegionSize",
                "value": "0x003dd000"
              },
              {
                "name": "FreeType",
                "value": "0x00008000"
              }
            ],
            "repeated": 0,
            "id": 16575
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x01"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16576
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xec\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xec\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16577
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd7\\x1a\\x1d5"
              },
              {
                "name": "Length",
                "value": "4"
              }
            ],
            "repeated": 0,
            "id": 16578
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtReadFile",
            "status": false,
            "return": "0xffffffffc0000011",
            "pretty_return": "END_OF_FILE",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": ""
              },
              {
                "name": "Length",
                "value": "0"
              }
            ],
            "repeated": 0,
            "id": 16579
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x00000474"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              },
              {
                "name": "Buffer",
                "value": "\\xd9\\xd5\\x05\\xf9 \\xa1c\\xd7\\x00\\x00\\x00\\x03"
              },
              {
                "name": "Length",
                "value": "12"
              }
            ],
            "repeated": 0,
            "id": 16580
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "SQLite format 3\\x00\\x10\\x00\\x01\\x01\\x00@  \\x00\\x00\\x00\\xed\\x00\\x00\\x07\\xc3\\x00\\x00\\x00!\\x00\\x00\\x03\\xcd\\x00\\x00\\x00\\x06\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xed\\x00.8\\x08\\x05\\x00\\x00\\x00\\x01\\x0f\\xfb\\x00\\x00\\x00\\x00\r\\x0f\\xfb\r\\xa3\\x06\\xf3\n\\xde\\x026\\x06\\x85\\x01\\xc8\\x01\\xc8\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16581
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x18-\\x00s\\x00p\\x00e\\x00c\\x00i\\x00f\\x00i\\x00c\\x00 \\x00s\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00-\\x00r\\x00e\\x00l\\x00a\\x00t\\x00e\\x00d\\x00 \\x00v\\x00u\\x00l\\x00n\\x00e\\x00r\\x00a\\x00b\\x00i\\x00l\\x00i\\x00t\\x00y\\x00.\\x00 \\x00S\\x00e\\x00c\\x00u\\x00r\\x00i\\x00t\\x00y\\x00 \\x00v\\x00u\\x00l\\x00n\\x00e\\x00r\\x00a\\x00b\\x00i\\x00l\\x00i\\x00t\\x00i\\x00e\\x00s\\x00 \\x00a\\x00r\\x00e\\x00 \\x00r\\x00a\\x00t\\x00e\\x00d\\x00 \\x00b\\x00a\\x00s\\x00e\\x00d\\x00 \\x00o\\x00n\\x00 \\x00t\\x00h\\x00e\\x00i\\x00r\\x00 \\x00s\\x00e\\x00v\\x00e\\x00r\\x00i\\x00t\\x00y\\x00 \\x00w\\x00h\\x00i\\x00c\\x00h\\x00 \\x00i\\x00s\\x00 \\x00i\\x00n\\x00d\\x00i\\x00c\\x00a\\x00t\\x00e\\x00d\\x00 \\x00i\\x00n\\x00 \\x00t\\x00h\\x00e\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16582
          },
          {
            "timestamp": "2026-05-28 22:33:02,559",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtWriteFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileHandle",
                "value": "0x000002f4"
              },
              {
                "name": "HandleName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
              },
              {
                "name": "Buffer",
                "value": "\\x00\\x00\\x00\\x00.\\x00d\\x00l\\x00.\\x00d\\x00e\\x00l\\x00i\\x00v\\x00e\\x00r\\x00y\\x00.\\x00m\\x00p\\x00.\\x00m\\x00i\\x00c\\x00r\\x00o\\x00s\\x00o\\x00f\\x00t\\x00.\\x00c\\x00o\\x00m\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00t\\x00r\\x00e\\x00a\\x00m\\x00i\\x00n\\x00g\\x00s\\x00e\\x00r\\x00v\\x00i\\x00c\\x00e\\x00/\\x00f\\x00i\\x00l\\x00e\\x00s\\x00/\\x00c\\x00e\\x00a\\x00b\\x001\\x002\\x00d\\x00c\\x00-\\x003\\x002\\x00f\\x00a\\x00-\\x004\\x007\\x005\\x002\\x00-\\x00b\\x00e\\x009\\x002\\x00-\\x002\\x005\\x009\\x00e\\x004\\x00e\\x009\\x009\\x001\\x000\\x009\\x00e\\x00?\\x00P\\x001\\x00=\\x001\\x007\\x007\\x009\\x009\\x008\\x005\\x000\\x003\\x007\\x00&\\x00P\\x002\\x00=\\x004\\x000\\x004\\x00&\\x00P\\x003\\x00=\\x002\\x00&\\x00P\\x004\\x00=\\x00O\\x00z\\x009\\x00"
              },
              {
                "name": "Length",
                "value": "4096"
              }
            ],
            "repeated": 0,
            "id": 16583
          },
          {
            "timestamp": "2026-05-28 22:33:02,575",
            "thread_id": "13048",
            "caller": "0x7ff6d4866b98",
            "parentcaller": "0x7ff6d47ee16d",
            "category": "filesystem",
            "api": "NtQueryAttributesFile",
            "status": true,
            "return": "0x00000000",
            "arguments": [
              {
                "name": "FileName",
                "value": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
              }
            ],
            "repeated": 0,
            "id": 16584
          }
        ],
        "threads": [
          "4572",
          "12420",
          "12416",
          "12412",
          "12408",
          "12584",
          "12596",
          "12604",
          "12624",
          "12628",
          "12632",
          "12644",
          "12648",
          "12928",
          "13048",
          "13044"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\System32\\mousocoreworker.exe -Embedding",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff6d47b0000",
          "MainExeSize": "0x001ad000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      },
      {
        "process_id": 1384,
        "process_name": "svchost.exe",
        "parent_id": 672,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "first_seen": "2026-05-28 22:32:58,995",
        "calls": [],
        "threads": [],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff71f590000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        },
        "file_activities": {
          "read_files": [],
          "write_files": [],
          "delete_files": []
        }
      }
    ],
    "anomaly": [],
    "processtree": [
      {
        "name": "explorer.exe",
        "pid": 4676,
        "parent_id": 4608,
        "module_path": "C:\\Windows\\explorer.exe",
        "children": [
          {
            "name": "msedge.exe",
            "pid": 7284,
            "parent_id": 4676,
            "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe",
            "children": [
              {
                "name": "identity_helper.exe",
                "pid": 11832,
                "parent_id": 7284,
                "module_path": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe",
                "children": [],
                "threads": [
                  "11836",
                  "11976",
                  "11972",
                  "11968",
                  "11964",
                  "12168",
                  "12176",
                  "12184",
                  "12188",
                  "12192",
                  "12196",
                  "12200",
                  "12204",
                  "12232",
                  "12256",
                  "12260",
                  "12264",
                  "12268",
                  "11416",
                  "8132",
                  "11940"
                ],
                "environ": {
                  "UserName": "admin",
                  "ComputerName": "JOHNS-PC",
                  "WindowsPath": "C:\\Windows",
                  "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
                  "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8",
                  "RegisteredOwner": "",
                  "RegisteredOrganization": "",
                  "ProductName": "",
                  "SystemVolumeSerialNumber": "12bc-0026",
                  "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
                  "MachineGUID": "",
                  "MainExeBase": "0x7ff61efc0000",
                  "MainExeSize": "0x0028c000",
                  "Bitness": "64-bit"
                }
              }
            ],
            "threads": [
              "7496",
              "5236",
              "2140",
              "4568",
              "4556",
              "5452",
              "1668",
              "5796",
              "8008",
              "6904",
              "2744",
              "7980",
              "6344",
              "8048",
              "9928",
              "2040",
              "9952",
              "7968",
              "9588",
              "1676",
              "3176",
              "3880",
              "11744",
              "4876",
              "2388"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://sugarcraft.net/\"",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff6f9430000",
              "MainExeSize": "0x00505000",
              "Bitness": "64-bit"
            }
          },
          {
            "name": "msinfo32.exe",
            "pid": 8372,
            "parent_id": 4676,
            "module_path": "C:\\Windows\\System32\\msinfo32.exe",
            "children": [],
            "threads": [
              "7460",
              "8844",
              "1164",
              "8840",
              "8964",
              "2864",
              "10600",
              "2644",
              "9288"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "\"C:\\Windows\\system32\\msinfo32.exe\" ",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff726ad0000",
              "MainExeSize": "0x00067000",
              "Bitness": "64-bit"
            }
          },
          {
            "name": "msinfo32.exe",
            "pid": 2380,
            "parent_id": 4676,
            "module_path": "C:\\Windows\\System32\\msinfo32.exe",
            "children": [],
            "threads": [
              "2404",
              "6572",
              "8132",
              "5980",
              "6468",
              "9544",
              "9668",
              "9680",
              "9684"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "\"C:\\Windows\\system32\\msinfo32.exe\" ",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff726ad0000",
              "MainExeSize": "0x00067000",
              "Bitness": "64-bit"
            }
          }
        ],
        "threads": [
          "6208",
          "5300",
          "5468",
          "4824",
          "4900",
          "5160",
          "5220",
          "8044",
          "6168",
          "5456",
          "4840",
          "5700",
          "5460",
          "5496",
          "8336",
          "5388",
          "6272",
          "5216",
          "6204",
          "6200",
          "6196",
          "6184",
          "5196",
          "5268",
          "5400",
          "1960",
          "4704",
          "6252",
          "5564",
          "6244"
        ],
        "environ": {
          "UserName": "admin",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
          "CommandLine": "C:\\Windows\\Explorer.EXE",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff663980000",
          "MainExeSize": "0x00546000",
          "Bitness": "64-bit"
        }
      },
      {
        "name": "svchost.exe",
        "pid": 840,
        "parent_id": 672,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "children": [
          {
            "name": "WmiPrvSE.exe",
            "pid": 9420,
            "parent_id": 840,
            "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "children": [],
            "threads": [
              "2516",
              "1716",
              "10292",
              "10324",
              "10296",
              "10432"
            ],
            "environ": {
              "UserName": "JOHNS-PC$",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Windows\\TEMP\\",
              "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff7c5600000",
              "MainExeSize": "0x0007e000",
              "Bitness": "64-bit"
            }
          },
          {
            "name": "WmiPrvSE.exe",
            "pid": 10576,
            "parent_id": 840,
            "module_path": "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
            "children": [],
            "threads": [
              "10580",
              "10708",
              "10716",
              "10720",
              "10712",
              "10796",
              "10808",
              "10812",
              "10816",
              "10840"
            ],
            "environ": {
              "UserName": "SYSTEM",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Windows\\TEMP\\",
              "CommandLine": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff7c5600000",
              "MainExeSize": "0x0007e000",
              "Bitness": "64-bit"
            }
          },
          {
            "name": "dllhost.exe",
            "pid": 3704,
            "parent_id": 840,
            "module_path": "C:\\Windows\\System32\\dllhost.exe",
            "children": [],
            "threads": [
              "3808",
              "8612",
              "3664",
              "3796",
              "3764",
              "9112",
              "1164",
              "8964",
              "8844"
            ],
            "environ": {
              "UserName": "admin",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Users\\admin\\AppData\\Local\\Temp\\",
              "CommandLine": "C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff7bdf50000",
              "MainExeSize": "0x00009000",
              "Bitness": "64-bit"
            }
          },
          {
            "name": "mousocoreworker.exe",
            "pid": 8032,
            "parent_id": 840,
            "module_path": "C:\\Windows\\System32\\mousocoreworker.exe",
            "children": [],
            "threads": [
              "4572",
              "12420",
              "12416",
              "12412",
              "12408",
              "12584",
              "12596",
              "12604",
              "12624",
              "12628",
              "12632",
              "12644",
              "12648",
              "12928",
              "13048",
              "13044"
            ],
            "environ": {
              "UserName": "SYSTEM",
              "ComputerName": "JOHNS-PC",
              "WindowsPath": "C:\\Windows",
              "TempPath": "C:\\Windows\\TEMP\\",
              "CommandLine": "C:\\Windows\\System32\\mousocoreworker.exe -Embedding",
              "RegisteredOwner": "",
              "RegisteredOrganization": "",
              "ProductName": "",
              "SystemVolumeSerialNumber": "12bc-0026",
              "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
              "MachineGUID": "",
              "MainExeBase": "0x7ff6d47b0000",
              "MainExeSize": "0x001ad000",
              "Bitness": "64-bit"
            }
          }
        ],
        "threads": [
          "940",
          "936",
          "4308",
          "1452",
          "1060"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff71f590000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        }
      },
      {
        "name": "svchost.exe",
        "pid": 5020,
        "parent_id": 672,
        "module_path": "C:\\Windows\\System32\\svchost.exe",
        "children": [],
        "threads": [
          "4820",
          "10164",
          "10172",
          "4984",
          "10300",
          "10372",
          "10444",
          "10016",
          "8128",
          "8024",
          "8700",
          "5836",
          "8580",
          "10064",
          "10048",
          "12508",
          "4736"
        ],
        "environ": {
          "UserName": "SYSTEM",
          "ComputerName": "JOHNS-PC",
          "WindowsPath": "C:\\Windows",
          "TempPath": "C:\\Windows\\TEMP\\",
          "CommandLine": "C:\\Windows\\system32\\svchost.exe -k netsvcs -p",
          "RegisteredOwner": "",
          "RegisteredOrganization": "",
          "ProductName": "",
          "SystemVolumeSerialNumber": "12bc-0026",
          "SystemVolumeGUID": "528c102f-0000-0000-0000-300300000000",
          "MachineGUID": "",
          "MainExeBase": "0x7ff71f590000",
          "MainExeSize": "0x00010000",
          "Bitness": "64-bit"
        }
      }
    ],
    "summary": {
      "files": [
        "\\Device\\Bam",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk",
        "C:\\Windows\\System32\\msinfo32.exe",
        "C:\\Windows\\System32\\msinfo32.exe\\",
        "C:\\Windows\\System32",
        "C:\\Windows\\System32\\",
        "C:\\Windows",
        "C:\\Windows\\",
        "C:",
        "\\??\\MountPointManager",
        "\\??\\Volume{528c102f-0000-0000-0000-300300000000}",
        "C:\\ProgramData\\Microsoft\\",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\System Information.lnk\\",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu",
        "C:\\ProgramData\\Microsoft\\Windows",
        "C:\\ProgramData\\Microsoft\\Windows\\",
        "C:\\ProgramData\\Microsoft",
        "C:\\ProgramData",
        "C:\\ProgramData\\",
        "C:\\Windows\\WinSxS\\FileMaps\\$$_system32_21f9a9c4a2f8b514.cdf-ms",
        "C:\\Users\\admin\\Desktop",
        "C:\\Users\\admin\\Desktop\\%1",
        "C:\\Users\\Public\\Desktop",
        "C:\\Users\\Public\\Desktop\\%1",
        "C:\\",
        "C:\\ProgramData\\Microsoft\\desktop.ini",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Administrative Tools\\desktop.ini",
        "C:\\Users\\admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations",
        "C:\\Users\\admin\\AppData\\Local\\Microsoft\\Windows\\Explorer",
        "C:\\Windows\\apppatch\\sysmain.sdb",
        "C:\\Program Files (x86)\\Microsoft\\",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\",
        "C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk",
        "C:\\program files (x86)\\microsoft\\Edge\\application\\msedge.exe",
        "C:\\program files (x86)\\microsoft\\Edge\\SystemResources\\msedge.exe.mun",
        "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-LIGHT.svg",
        "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.Windows.Search_cw5n1h2txyewy\\LocalState\\ShellFeeds\\GLEAM-DARK.svg",
        "C:\\Windows\\System32\\twinui.pcshell.dll",
        "C:\\Windows\\System32\\SecurityHealthSSO.dll",
        "C:\\Windows\\System32\\wscui.cpl",
        "C:\\Windows\\System32\\en-US\\wscui.cpl.mui",
        "C:\\Windows\\System32\\en-US\\Actioncenter.dll.mui",
        "C:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
        "\\??\\PhysicalDrive0",
        "C:\\Windows\\System32\\mousocoreworker.exe",
        "C:\\Windows\\WindowsShell.Manifest",
        "C:\\Windows\\System32\\umpdc.dll",
        "C:\\Windows\\System32\\kernel.appcore.dll",
        "C:\\Windows\\Globalization\\Sorting\\sortdefault.nls",
        "C:\\Windows\\Fonts\\staticcache.dat",
        "C:\\Windows\\System32\\TextShaping.dll",
        "C:\\Windows\\System32\\uxtheme.dll.Config",
        "C:\\Windows\\System32\\uxtheme.dll",
        "C:\\Windows\\System32\\textinputframework.dll",
        "C:\\Windows\\System32\\CoreUIComponents.dll",
        "C:\\Windows\\System32\\CoreMessaging.dll",
        "C:\\Windows\\System32\\ntmarta.dll",
        "C:\\Windows\\System32\\WinTypes.dll",
        "\\??\\BitLocker\\Volume\\2\\SEI",
        "\\??\\BitLocker\\Volume\\2\\HEI",
        "C:\\Windows\\System32\\tbs.dll",
        "\\??\\TPM",
        "C:\\Windows\\System32\\propsys.dll",
        "C:\\Windows\\System32\\en-US\\PROPSYS.dll.mui",
        "C:\\Windows\\System32\\devobj.dll",
        "C:\\Windows\\INF\\pci.inf",
        "C:\\Windows\\System32\\DriverStore\\en-US\\pci.inf_loc",
        "C:\\Windows\\INF\\pci.PNF",
        "C:\\Windows\\INF\\machine.inf",
        "C:\\Windows\\System32\\DriverStore\\en-US\\machine.inf_loc",
        "C:\\Windows\\INF\\machine.PNF",
        "C:\\Windows\\System32\\Recovery\\ReAgent.xml",
        "\\??\\Volume{528c102f-0000-0000-0000-100000000000}",
        "\\\\?\\Volume{528c102f-0000-0000-0000-100000000000}\\",
        "\\\\?\\Volume{528c102f-0000-0000-0000-300300000000}\\",
        "\\??\\Volume{528c102f-0000-0000-0000-c0dd0e000000}",
        "\\\\?\\Volume{528c102f-0000-0000-0000-c0dd0e000000}\\",
        "\\??\\Volume{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}",
        "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE",
        "C:\\Windows\\System32\\Recovery\\Winre.wim",
        "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\WindowsRE\\",
        "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery",
        "\\??\\GLOBALROOT\\device\\harddisk0\\partition3\\Recovery\\",
        "\\??\\GLOBALROOT\\device\\harddisk0\\partition3",
        "\\??\\BitLocker\\Volume\\3\\SEI",
        "\\??\\BitLocker\\Volume\\3\\HEI",
        "C:\\Windows\\System32\\vssapi.dll",
        "C:\\Windows\\System32\\vsstrace.dll",
        "C:\\Windows\\System32\\en-US\\VssTrace.DLL.mui",
        "C:\\Windows\\System32\\samcli.dll",
        "C:\\Windows\\System32\\netutils.dll",
        "C:\\Windows\\System32\\samlib.dll",
        "C:\\Windows\\System32\\wbem\\repository",
        "C:\\Windows\\System32\\wbem\\repository\\WRITABLE.TST",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING2.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA",
        "C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR",
        "C:\\Windows\\System32\\userenv.dll",
        "C:\\Windows\\System32\\profapi.dll",
        "C:\\Program Files\\Windows Defender\\MpOAV.dll",
        "C:\\Windows\\System32\\cryptsp.dll",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
        "C:\\Windows\\SystemResources\\USER32.dll.mun",
        "C:\\Windows\\System32\\en-US\\USER32.dll.mui",
        "C:\\Windows\\System32\\rpcss.dll",
        "\\Device\\CNG",
        "C:\\Windows\\System32\\winbrand.dll",
        "C:\\Windows\\Branding\\Basebrd\\basebrd.dll",
        "C:\\Windows\\Branding\\Basebrd\\en-US\\Basebrd.dll.mui",
        "C:\\Windows\\System32\\secur32.dll",
        "C:\\Windows\\System32\\srvcli.dll",
        "C:\\Windows\\System32\\logoncli.dll",
        "C:\\Windows\\System32\\schedcli.dll",
        "C:\\Windows\\System32\\wkscli.dll",
        "C:\\Windows\\System32\\dsrole.dll",
        "\\??\\PIPE\\wkssvc",
        "\\??\\PIPE\\srvsvc",
        "C:\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui",
        "C:\\Windows\\System32\\wtsapi32.dll",
        "C:\\Windows\\System32\\winsta.dll",
        "C:\\Windows\\System32\\wmiclnt.dll",
        "\\??\\WMIDataDevice",
        "\\??\\PIPE\\lsarpc",
        "C:\\Windows\\System32\\OemInfo.Ini",
        "C:\\Windows\\System32\\OemLogo.Bmp",
        "C:\\Windows\\System32\\hal.dll",
        "C:\\Windows\\System32\\en-US\\tzres.dll.mui",
        "C:\\Windows\\System32\\usp10.dll",
        "\\??\\pipe\\crashpad_7284_GEGXVQJDPVSTZRQP",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\148.0.3967.83\\msedge.dll",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\icudtl.dat",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\v8_context_snapshot.bin",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_100_percent.pak",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_200_percent.pak",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\Locales\\en-US.pak",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\resources.pak",
        "C:\\Windows\\System32\\policymanager.dll",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msvcp110_win.dll",
        "C:\\Windows\\System32\\msvcp110_win.dll",
        "C:\\Windows\\System32\\usermgrcli.dll",
        "C:\\Windows\\System32\\capauthz.dll",
        "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\MSASN1.dll",
        "C:\\Windows\\System32\\msasn1.dll",
        "C:\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\S-1-5-21-3968686040-3210279463-847977608-1001.pckgdep",
        "C:\\Windows\\System32\\en-US\\KERNELBASE.dll.mui",
        "C:\\Windows\\System32\\windows.storage.dll",
        "C:\\Windows\\System32\\wldp.dll",
        "C:\\Windows\\SysWOW64\\propsys.dll",
        "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe",
        "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\",
        "C:\\Users\\admin\\AppData\\Local\\Packages",
        "C:\\Users\\admin\\AppData\\Local\\Packages\\",
        "C:\\Users\\admin\\AppData\\Local",
        "C:\\Users\\admin\\AppData\\Local\\",
        "C:\\Users\\admin\\AppData",
        "C:\\Users\\admin\\AppData\\",
        "C:\\Users\\admin",
        "C:\\Users\\admin\\",
        "C:\\Users",
        "C:\\Users\\",
        "\\Device\\DeviceApi\\CMApi",
        "\\??\\STORAGE#Volume#{e32a9442-5af2-11f1-ae2c-806e6f6e6963}#0000000003300000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}",
        "C:\\Users\\admin\\AppData\\Local\\Packages\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\LocalState\\ToastCollectionIcons\\*",
        "C:\\Windows\\System32\\UsoSelfhost.dll",
        "C:\\ProgramData\\USOShared",
        "C:\\ProgramData\\USOShared\\Logs",
        "C:\\ProgramData\\USOShared\\Logs\\System",
        "C:\\ProgramData\\USOShared\\Logs\\System\\*",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.13a40315-1b4b-44fb-bceb-0ac9d0e8d637.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.a1a5ab62-37db-4c6e-a99f-2dd742f7a2ff.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.a1a5ab62-37db-4c6e-a99f-2dd742f7a2ff.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.a1a5ab62-37db-4c6e-a99f-2dd742f7a2ff.3.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.b2c76306-97b7-4c8c-b9f0-4178717b5f9e.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.d1101e08-df9f-4307-8331-d8089b287d2b.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.2552a42b-ffbc-46bc-915e-0f13d4a35e82.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.decfc9c6-5753-489c-a7e7-63bcdfa32a05.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.decfc9c6-5753-489c-a7e7-63bcdfa32a05.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.decfc9c6-5753-489c-a7e7-63bcdfa32a05.3.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.72c536ce-f0a9-45b0-8943-d57989691ba2.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.3.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.83c1f861-7bb5-471b-a3a3-dedb21e3bc95.4.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.52b3bb53-50da-43e2-a227-8eee56d653f4.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.52b3bb53-50da-43e2-a227-8eee56d653f4.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.52b3bb53-50da-43e2-a227-8eee56d653f4.3.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.7eb22526-c9d8-474a-a640-c2711afee09f.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.7eb22526-c9d8-474a-a640-c2711afee09f.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.58407556-a7aa-4ece-be15-b623579ad3a0.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.58407556-a7aa-4ece-be15-b623579ad3a0.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.937edd1c-b31a-42ae-b43a-a5fef1121bff.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.937edd1c-b31a-42ae-b43a-a5fef1121bff.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.0c40a8b7-8c96-44ca-898f-830fcb363207.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.f78383b3-3d11-4f06-94bb-4259c0caa1e0.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.afe6ad17-1c4d-4f58-955e-3728f67e8730.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.9b10e438-09b6-42b5-b0ef-b89137a942d6.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.9b10e438-09b6-42b5-b0ef-b89137a942d6.2.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.9b10e438-09b6-42b5-b0ef-b89137a942d6.3.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.22cdc50a-cbbc-43d5-9b6f-1baf2061d080.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.b45f93e0-f36f-42dc-813e-744a27246b93.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.43ccf5e4-1a64-4806-a968-4dbbdacf42d8.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.d0de2613-3e9a-4f7a-917e-d63be9a15b6a.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.b79f1d0b-e492-41de-a46a-62bc2a94231b.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.daea7507-dffc-4d97-803c-02c903841e52.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.d8065493-d7b3-450d-bec9-4d0b7cd2aa27.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.9d0d101b-258a-40f4-92ef-6b1e4244a564.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.63023b64-7a0c-49ce-874f-111955c9e399.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.87eafcac-ca88-4bad-ba8d-d502a2b76bd5.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.5a750c04-2df5-4e80-9376-dc237123101f.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.c7554215-ef05-48af-a85d-890d84e75d01.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.5e2f3d21-5ec7-48df-a172-b94291764279.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.c294fc97-7fbd-4ef0-9dda-00a41c45cbf3.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.c48e4ebc-c7f0-4655-8df7-4bbde3bcef8d.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.86e3852b-7fa1-4e18-b069-98171a34fa8b.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.a11b7b39-47d3-4445-ba94-a9ffc89781cb.1.etl",
        "C:\\ProgramData\\USOPrivate",
        "C:\\ProgramData\\USOPrivate\\UpdateStore",
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db",
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal",
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-wal",
        "C:\\Windows\\System32\\upshared.dll",
        "C:\\Windows\\System32\\winhttp.dll",
        "C:\\Windows\\System32\\dpapi.dll",
        "C:\\Windows\\SoftwareDistribution",
        "C:\\Windows\\SoftwareDistribution\\autest.cab",
        "C:\\Windows\\System32\\productenumerator.dll",
        "C:\\Windows\\system32"
      ],
      "read_files": [],
      "write_files": [
        "\\??\\TPM",
        "C:\\Windows\\System32\\wbem\\repository\\WRITABLE.TST",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING1.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING2.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\MAPPING3.MAP",
        "C:\\Windows\\System32\\wbem\\repository\\OBJECTS.DATA",
        "C:\\Windows\\System32\\wbem\\repository\\INDEX.BTR",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2WMI SELF-INSTRUMENTATION EVENT PROVIDER",
        "\\??\\pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM",
        "\\??\\PIPE\\wkssvc",
        "\\??\\PIPE\\srvsvc",
        "\\??\\WMIDataDevice",
        "\\??\\PIPE\\lsarpc",
        "C:\\Windows\\System32\\hal.dll",
        "\\??\\pipe\\crashpad_7284_GEGXVQJDPVSTZRQP",
        "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl",
        "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.a11b7b39-47d3-4445-ba94-a9ffc89781cb.1.etl",
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db",
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "delete_files": [
        "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
      ],
      "keys": [
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\SideBySide",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
        "HKEY_CURRENT_USER",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE\\AppCompat",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
        "HKEY_CURRENT_USER\\Software\\Classes",
        "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\msinfo32.exe",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\CustomLocale",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\ExtendedLocale",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Session Manager",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
        "HKEY_CURRENT_USER\\Control Panel\\Desktop",
        "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Nls\\Sorting\\Ids",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontLink\\SystemLink",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Segoe UI",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\msinfo32.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\Compatibility\\AppCompatClassName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Input",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\MS Shell Dlg",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\Elevation",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WBEM\\CIMOM",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\SystemSKU",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMajorRelease",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMinorRelease",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\SecureBoot\\State",
        "HKEY_LOCAL_MACHINE\\Software",
        "HKEY_LOCAL_MACHINE\\System",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\LanguageOverlay\\OverlayPackages\\en-US",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\MiniNT",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\PortableOperatingSystem",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\HSTI",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\HSTI\\HSTIVerificationRequired",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\UnallowedBuses",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\UnallowedBuses",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\Default\\AllowedBuses",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\DmaSecurity\\AllowedBuses",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryption",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryptionForAzureADJoinedDevices",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\MiniNT",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimValidated",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimHash",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\CTF\\DirectSwitchHotkeys",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Wbem\\Cimom",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Policies\\Microsoft\\Cryptography\\Configuration",
        "HKEY_LOCAL_MACHINE\\Software\\Classes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\wmiprvse.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\Elevation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)",
        "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InProcServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\(Default)",
        "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\Synchronization",
        "HKEY_CLASSES_ROOT\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\AppId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}",
        "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel",
        "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap",
        "HKEY_LOCAL_MACHINE\\Software\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\OEM",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\CLSID\\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\COM3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsRuntime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE\\Diagnosis",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\OLE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\identity_helper.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\OLE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{E1CDD77A-65D3-4DB0-B339-21F6A48CC2FF}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AF86E2E0-B12D-4C6A-9C5A-D7AA65101E90}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{50AC103F-D235-4598-BBEF-98FE4D1A3AD4}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{428D4DDD-3462-43DF-9395-1EFF13AE7A4B}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6DB7CD52-E3B7-4ECC-BB1F-388AEEF6BB50}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{B03C2205-F02E-4D77-80DF-E1747AFDD39C}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\Elevation",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7AB93C52-0E48-4750-BA9D-1A4113981847}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5CADDC63-01D3-4C97-986F-0533483FEE14}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BC3D253-2F31-4092-9129-8AD5ABF067DA}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\AppPrivacy",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Privacy",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0C9281F9-6DA1-4006-8729-DE6E6B61581C}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocServer32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\TreatAs",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\Elevation",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{5232F8EA-49C7-4840-BFBB-66E785689E88}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{0450CE77-AF0D-40AC-93FD-1E5D48C89419}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{195F5943-0C04-4EAB-B907-735817FDAC77}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{926516E8-D891-45BC-9DE5-6959FB8ECAC5}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{79AB57F6-43FE-487B-8A7F-99567200AE94}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\msasn1",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapDBRedirect",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Appx",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{23EB7394-4610-4807-BAEC-9A72F86FFA0B}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\XAML",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CustomAttributes",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\Elevation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)",
        "HKEY_USERS",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{B3F72108-5C5C-469B-A5E5-3F64D2A39B01}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{D81E96F1-A89C-417E-9335-59531026309D}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{3BED20A5-6DEE-4297-B976-3B30DF69A7AA}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7F290DA0-75E3-5885-898D-1F5B1ED47ED2}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{9ED07B24-36FD-543B-948E-B01FE5814B49}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{EFE869FC-5841-55F1-AA56-82C7219AAA09}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ShellCompatibility\\Applications\\identity_helper.exe",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
        "HKEY_CLASSES_ROOT\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SyncRootManager",
        "HKEY_CLASSES_ROOT\\Directory",
        "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\LibraryDescriptionHandler",
        "HKEY_CLASSES_ROOT\\Folder",
        "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\LibraryDescriptionHandler",
        "HKEY_CLASSES_ROOT\\AllFilesystemObjects",
        "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\LibraryDescriptionHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
        "HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\IconHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
        "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\BrowseInPlace",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\BrowseInPlace",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\BrowseInPlace",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
        "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Generation",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PropertyBag",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\SessionInfo\\1\\KnownFolders",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PropertyBag",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PropertyBag",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PropertyBag",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PropertyBag",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PropertyBag",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PropertyBag",
        "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler",
        "HKEY_LOCAL_MACHINE\\Software\\Classes\\Directory\\ShellEx\\PropertyHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\Folder\\ShellEx\\PropertyHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\ShellEx\\PropertyHandler",
        "HKEY_CURRENT_USER\\Software\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\ShellEx\\PropertyHandler",
        "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions",
        "HKEY_CLASSES_ROOT\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\Elevation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{E44EA1DF-BB85-5A8C-BDDC-C8E960C355C9}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8CBD762A-1222-5EE5-B745-489E7A42C6EC}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{6D3BC882-23A4-4706-B8FA-FC7DE2FC325D}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\AdminCapabilities",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience",
        "HKEY_CURRENT_USER\\Software\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalService",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RunAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateAtStorage",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ROTFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppIDFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\MGOTFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProcessMitigationPolicy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RemoteServerName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\SRPTrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\PreferredServerBitness",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LoadUserSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProtectionLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AccessPermission",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Rpc\\Extensions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\Elevation",
        "HKEY_CURRENT_USER\\Software\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\ThreadingModel",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler32",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\AppID",
        "HKEY_CURRENT_USER\\Software\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\Elevation",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Compression",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator\\Configurations",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\TestHooks",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\~MHz",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\TimeZoneInformation",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\Bias",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardBias",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardStart",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightBias",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightStart",
        "HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerCorrelationId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\mousocoreworker.exe",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\mousocoreworker.exe\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AccessPermission",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\Elevation",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\AllowedUpdateManagerCtorFailures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEngine",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\isV2Provider",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun\\isV2Provider",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso\\isV2Provider",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\LocaleName",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sList",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sDecimal",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sThousand",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sGrouping",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sNativeDigits",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonDecimalSep",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonThousandSep",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonGrouping",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sPositiveSign",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sNegativeSign",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sTimeFormat",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sShortTime",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\s1159",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\s2359",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sShortDate",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sYearMonth",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sLongDate",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCountry",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iMeasure",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iPaperSize",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iDigits",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iLZero",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iNegNumber",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\NumShape",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCurrDigits",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCurrency",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iNegCurr",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iFirstDayOfWeek",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iFirstWeekOfYear",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sCurrency",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCalendarType",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Currencies",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Calendar",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Gregorian",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\RebootRequired",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{9482F4B4-E343-43B6-B170-9A65BC822C77}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Setup\\SetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings\\RootDirectory",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Test",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Auto Update\\CommitRequired\\{8B24B027-1DEE-BABB-9A95-3517DFB9C552}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\cmdLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterDisabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\scanFrequency",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupSupported",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\WinInit",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\WinInit\\Headless",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\RebootDowntime",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\PolicyTestHooks",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UpdatePolicy\\GPCache",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\Update",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\DetectionFrequency",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\TreatAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InprocHandler32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InprocHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\LocalServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\LocalServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\Elevation",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfhost\\ClientState",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\PilotInfoRing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\ErrorState",
        "HKEY_LOCAL_MACHINE\\System\\Setup",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\CustomAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfhost\\Applicability",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\IsBuildFlightingEnabled",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsSelfhost\\OneSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\OneSettings\\IsBuildUnsupported",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate",
        "HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\PreviewBuilds",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Value",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Value",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\current\\Device\\System",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINDOWSUPDATE\\WINREUNINSTALLLIST",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Overrides\\BSP\\",
        "HKEY_LOCAL_MACHINE\\System\\Platform\\DeviceTargetingInfo\\",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AUPowerManagement",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerEndHour",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\UX\\Settings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerStartHour",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDelayInMinutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDurationInMinutes",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\FirstEntry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\LastEntry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2026",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2007",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
        "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\WindowsUpdate\\Orchestrator",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\EnhancedShutdownEnabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\UsePowerButtonIcon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}\\ProxyStubClsid32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}\\ProxyStubClsid32\\(Default)"
      ],
      "read_keys": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
        "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\SystemSKU",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMajorRelease",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMinorRelease",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\PortableOperatingSystem",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\HSTI\\HSTIVerificationRequired",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryption",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryptionForAzureADJoinedDevices",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimValidated",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimHash",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\Synchronization",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\AppId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
        "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Data",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Generation",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
        "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalService",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RunAs",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateAtStorage",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ROTFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppIDFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\MGOTFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProcessMitigationPolicy",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RemoteServerName",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\SRPTrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\PreferredServerBitness",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LoadUserSettings",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProtectionLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AccessPermission",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\AppID",
        "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\~MHz",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\Bias",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardBias",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardStart",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightName",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightBias",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightStart",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerCorrelationId",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\mousocoreworker.exe\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AuthenticationLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AccessPermission",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\AllowedUpdateManagerCtorFailures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEngine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\isV2Provider",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun\\isV2Provider",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso\\isV2Provider",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\LocaleName",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sList",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sDecimal",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sThousand",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sGrouping",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sNativeDigits",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonDecimalSep",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonThousandSep",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sMonGrouping",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sPositiveSign",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sNegativeSign",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sTimeFormat",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sShortTime",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\s1159",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\s2359",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sShortDate",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sYearMonth",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sLongDate",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCountry",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iMeasure",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iPaperSize",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iDigits",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iLZero",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iNegNumber",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\NumShape",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCurrDigits",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCurrency",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iNegCurr",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iFirstDayOfWeek",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iFirstWeekOfYear",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sCurrency",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCalendarType",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Currencies",
        "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Calendar",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings\\RootDirectory",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\cmdLine",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterDisabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\scanFrequency",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupSupported",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\WinInit\\Headless",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\DetectionFrequency",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\InprocServer32",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\ThreadingModel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\AppID",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\PilotInfoRing",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\ErrorState",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivationType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Server",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\DllPath",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Threading",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\TrustLevel",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\RemoteServer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateAsUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInSharedBroker",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInBrokerForMediumILContainer",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Permissions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateOnHostFlags",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}\\ProxyStubClsid32\\(Default)",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\IsBuildFlightingEnabled",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\OneSettings\\IsBuildUnsupported",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\PolicyType",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\MergeAlgorithm",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirectMapped",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirect",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\grouppolicyname",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataUser",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataDevice",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataBoth",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\30Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Value",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AUPowerManagement",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerEndHour",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerStartHour",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDelayInMinutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDurationInMinutes",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\FirstEntry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\LastEntry",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2026",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2007",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\UsePowerButtonIcon",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}\\ProxyStubClsid32\\(Default)"
      ],
      "write_keys": [
        "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus",
        "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions"
      ],
      "delete_keys": [
        "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\EnhancedShutdownEnabled"
      ],
      "executed_commands": [
        "\"C:\\Windows\\system32\\msinfo32.exe\"",
        "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding",
        "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding",
        "C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}",
        "C:\\Windows\\System32\\mousocoreworker.exe -Embedding",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x348,0x35c,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2464,i,6363073462286893154,122142860457183492,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2556 /prefetch:3",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,11285122921339835690,13411714936228308146,262144 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2324 /prefetch:2",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2620,i,16624453374801861901,2017422552223441830,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72010649 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3524,i,12540446788744744878,2483364207054016915,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3532 /prefetch:1",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72015610 --skip-read-main-dll --metrics-shmem-handle=3612,i,2898914090110436564,14889825992066690183,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3664 /prefetch:1",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5320,i,17754333930940707777,4047379628757978089,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5324 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5560,i,10756999430082579342,5291797573898009904,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5576 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,7756914649097871830,5918365439921352,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=1412 /prefetch:8",
        "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5700,i,1918180883024487797,9552434258275741559,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6332 /prefetch:8"
      ],
      "resolved_apis": [
        "ntdll.dll.RtlWow64GetCurrentMachine",
        "ntdll.dll.RtlWow64IsWowGuestMachineSupported"
      ],
      "mutexes": [
        "Local\\SM0:8372:304:WilStaging_02",
        "Local\\SM0:8372:120:WilError_03",
        "Local\\MSCTF.Asm.MutexDefault1",
        "CicLoadWinStaWinSta0",
        "Local\\MSCTF.CtfMonitorInstMutexDefault1",
        "Local\\SM0:2380:304:WilStaging_02",
        "Local\\SM0:2380:120:WilError_03",
        "Local\\SM0:10576:304:WilStaging_02",
        "Local\\SM0:11832:304:WilStaging_02",
        "Local\\SM0:11832:120:WilError_03",
        "Local\\SM0:3704:304:WilStaging_02",
        "Global\\MoUsoCoreworkerRunning",
        "Local\\SM0:8032:304:WilStaging_02"
      ],
      "created_services": [],
      "started_services": [
        "MicrosoftEdgeElevationService"
      ]
    },
    "enhanced": [
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:54,727",
        "eid": 1,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,024",
        "eid": 2,
        "data": {
          "file": "C:\\Windows\\System32\\shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,055",
        "eid": 3,
        "data": {
          "file": "\"C:\\Windows\\system32\\msinfo32.exe\" "
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,055",
        "eid": 4,
        "data": {
          "file": "C:\\Windows\\System32\\sfc_os.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff84d70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,071",
        "eid": 5,
        "data": {
          "file": "C:\\Windows\\System32\\windows.internal.shell.broker.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7c210000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,336",
        "eid": 6,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,336",
        "eid": 7,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,336",
        "eid": 8,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,352",
        "eid": 9,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,352",
        "eid": 10,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,352",
        "eid": 11,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,399",
        "eid": 12,
        "data": {
          "file": "\"C:\\Windows\\system32\\msinfo32.exe\" "
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,399",
        "eid": 13,
        "data": {
          "file": "C:\\Windows\\System32\\sfc_os.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff84d70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,539",
        "eid": 14,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,555",
        "eid": 15,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,555",
        "eid": 16,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,555",
        "eid": 17,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,555",
        "eid": 18,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,586",
        "eid": 19,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,586",
        "eid": 20,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 21,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,649",
        "eid": 22,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 23,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 24,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 25,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 26,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,743",
        "eid": 27,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,743",
        "eid": 28,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,743",
        "eid": 29,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,758",
        "eid": 30,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,758",
        "eid": 31,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,758",
        "eid": 32,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,758",
        "eid": 33,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,758",
        "eid": 34,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,789",
        "eid": 35,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,821",
        "eid": 36,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,821",
        "eid": 37,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,821",
        "eid": 38,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,821",
        "eid": 39,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,836",
        "eid": 40,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,836",
        "eid": 41,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,836",
        "eid": 42,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,868",
        "eid": 43,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,899",
        "eid": 44,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,930",
        "eid": 45,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,946",
        "eid": 46,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,961",
        "eid": 47,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,977",
        "eid": 48,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,993",
        "eid": 49,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,024",
        "eid": 50,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,852",
        "eid": 51,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,852",
        "eid": 52,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,883",
        "eid": 53,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,899",
        "eid": 54,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,914",
        "eid": 55,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,930",
        "eid": 56,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,946",
        "eid": 57,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,102",
        "eid": 58,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,118",
        "eid": 59,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,133",
        "eid": 60,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,164",
        "eid": 61,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,180",
        "eid": 62,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,196",
        "eid": 63,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,211",
        "eid": 64,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,227",
        "eid": 65,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,243",
        "eid": 66,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,258",
        "eid": 67,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,274",
        "eid": 68,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,305",
        "eid": 69,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,321",
        "eid": 70,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,336",
        "eid": 71,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,352",
        "eid": 72,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:02,243",
        "eid": 73,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 74,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,852",
        "eid": 75,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,852",
        "eid": 76,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:07,633",
        "eid": 77,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:10,539",
        "eid": 78,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95330000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:40,993",
        "eid": 79,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95330000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,696",
        "eid": 80,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,696",
        "eid": 81,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,868",
        "eid": 82,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,883",
        "eid": 83,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,899",
        "eid": 84,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,914",
        "eid": 85,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,930",
        "eid": 86,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,946",
        "eid": 87,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,961",
        "eid": 88,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,977",
        "eid": 89,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,993",
        "eid": 90,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:49,024",
        "eid": 91,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:49,039",
        "eid": 92,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:49,055",
        "eid": 93,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:49,071",
        "eid": 94,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:49,086",
        "eid": 95,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:49,102",
        "eid": 96,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,774",
        "eid": 97,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95330000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,789",
        "eid": 98,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95330000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,586",
        "eid": 99,
        "data": {
          "file": "C:\\Windows\\System32\\wscinterop.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff38ee0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,602",
        "eid": 100,
        "data": {
          "file": "C:\\Windows\\System32\\werconcpl.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff38de0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,633",
        "eid": 101,
        "data": {
          "file": "C:\\Windows\\System32\\hcproviders.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff38dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,353",
        "eid": 102,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95330000"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:00,603",
        "eid": 103,
        "data": {
          "file": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:00,978",
        "eid": 104,
        "data": {
          "file": "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
        }
      },
      {
        "event": "start",
        "object": "service",
        "timestamp": "2026-05-28 22:32:02,572",
        "eid": 105,
        "data": {
          "service": "MicrosoftEdgeElevationService"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:52,994",
        "eid": 106,
        "data": {
          "file": "C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,681",
        "eid": 107,
        "data": {
          "file": "C:\\Windows\\System32\\mousocoreworker.exe -Embedding"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,336",
        "eid": 108,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=crashpad-handler \"--user-data-dir=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=148.0.7778.180 \"--annotation=exe=C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=148.0.3967.83 --initial-client-data=0x34c,0x350,0x354,0x348,0x35c,0x7fff52985d58,0x7fff52985d64,0x7fff52985d70"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,493",
        "eid": 109,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=2464,i,6363073462286893154,122142860457183492,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2556 /prefetch:3"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,539",
        "eid": 110,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=2172,i,11285122921339835690,13411714936228308146,262144 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2324 /prefetch:2"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,539",
        "eid": 111,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2620,i,16624453374801861901,2017422552223441830,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2732 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,743",
        "eid": 112,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72010649 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=3524,i,12540446788744744878,2483364207054016915,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3532 /prefetch:1"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,758",
        "eid": 113,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale=en_AU --device-scale-factor=1 --num-raster-threads=3 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1780007447726326 --launch-time-ticks=72015610 --skip-read-main-dll --metrics-shmem-handle=3612,i,2898914090110436564,14889825992066690183,2097152 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3664 /prefetch:1"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:06,336",
        "eid": 114,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --skip-read-main-dll --metrics-shmem-handle=5320,i,17754333930940707777,4047379628757978089,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5324 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:07,493",
        "eid": 115,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5560,i,10756999430082579342,5291797573898009904,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5576 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:07,977",
        "eid": 116,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5804 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:29,477",
        "eid": 117,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=1656,i,7756914649097871830,5918365439921352,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=1412 /prefetch:8"
        }
      },
      {
        "event": "execute",
        "object": "file",
        "timestamp": "2026-05-28 22:32:59,555",
        "eid": 118,
        "data": {
          "file": "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5700,i,1918180883024487797,9552434258275741559,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744615,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=6332 /prefetch:8"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 119,
        "data": {
          "file": "MSVCRT.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7fff98030000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 120,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 121,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 122,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 123,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 124,
        "data": {
          "file": "LPK",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 125,
        "data": {
          "file": "GDI32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 126,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,174",
        "eid": 127,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,190",
        "eid": 128,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,190",
        "eid": 129,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff93cf0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,190",
        "eid": 130,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,190",
        "eid": 131,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,190",
        "eid": 132,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,190",
        "eid": 133,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,190",
        "eid": 134,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 135,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 136,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 137,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 138,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 139,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 140,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 141,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 142,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 143,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 144,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 145,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 146,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 147,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 148,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 149,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 150,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 151,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,205",
        "eid": 152,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,221",
        "eid": 153,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,221",
        "eid": 154,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,221",
        "eid": 155,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,221",
        "eid": 156,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,221",
        "eid": 157,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,221",
        "eid": 158,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,221",
        "eid": 159,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,237",
        "eid": 160,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,237",
        "eid": 161,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
          "content": "C:\\Windows\\Fonts\\staticcache.dat"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,237",
        "eid": 162,
        "data": {
          "file": "C:\\Windows\\Fonts\\StaticCache.dat"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 163,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 164,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
          "content": "SimSun-ExtB"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 165,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 166,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 167,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 168,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 169,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 170,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 171,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 172,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 173,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 174,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 175,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 176,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 177,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 178,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,252",
        "eid": 179,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,268",
        "eid": 180,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,268",
        "eid": 181,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,268",
        "eid": 182,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,268",
        "eid": 183,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,268",
        "eid": 184,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,283",
        "eid": 185,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,283",
        "eid": 186,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,283",
        "eid": 187,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,283",
        "eid": 188,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,299",
        "eid": 189,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,299",
        "eid": 190,
        "data": {
          "file": "comctl32",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,299",
        "eid": 191,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,299",
        "eid": 192,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,299",
        "eid": 193,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,299",
        "eid": 194,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,315",
        "eid": 195,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,315",
        "eid": 196,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,315",
        "eid": 197,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 198,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 199,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 200,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 201,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 202,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 203,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 204,
        "data": {
          "file": "api-ms-win-core-com-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96ff0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 205,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 206,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 207,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 208,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 209,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 210,
        "data": {
          "file": "iertutil.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 211,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 212,
        "data": {
          "file": "C:\\Windows\\System32\\msctf.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97f00000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,330",
        "eid": 213,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,346",
        "eid": 214,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,377",
        "eid": 215,
        "data": {
          "file": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,377",
        "eid": 216,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 217,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82a50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 218,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 219,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 220,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fc20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 221,
        "data": {
          "file": "amsi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 222,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 223,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 224,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 225,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,393",
        "eid": 226,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 227,
        "data": {
          "file": "C:\\Windows\\System32\\version.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff853a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 228,
        "data": {
          "file": "C:\\Program Files\\Windows Defender\\MpOAV.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d4d0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 229,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
          "content": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 230,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 231,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 232,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 233,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 234,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 235,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 236,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 237,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 238,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 239,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 240,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 241,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 242,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 243,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 244,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,408",
        "eid": 245,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,424",
        "eid": 246,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,440",
        "eid": 247,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,440",
        "eid": 248,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,440",
        "eid": 249,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\SystemSKU",
          "content": "SKU"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,455",
        "eid": 250,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMajorRelease",
          "content": "255"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,455",
        "eid": 251,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMinorRelease",
          "content": "255"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,455",
        "eid": 252,
        "data": {
          "file": "C:\\Windows\\System32\\fveapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8d860000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,455",
        "eid": 253,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,455",
        "eid": 254,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,455",
        "eid": 255,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,455",
        "eid": 256,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,471",
        "eid": 257,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,487",
        "eid": 258,
        "data": {
          "file": "fveapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8d860000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,487",
        "eid": 259,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,487",
        "eid": 260,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,487",
        "eid": 261,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\PortableOperatingSystem",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,487",
        "eid": 262,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\HSTI\\HSTIVerificationRequired",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,518",
        "eid": 263,
        "data": {
          "file": "kernelbase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,518",
        "eid": 264,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,518",
        "eid": 265,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 266,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 267,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 268,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryption",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 269,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryptionForAzureADJoinedDevices",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 270,
        "data": {
          "file": "reinfo.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fb70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 271,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 272,
        "data": {
          "file": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 273,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimValidated",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 274,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimHash",
          "content": "\\x01\\xec\\xce\\xdbE\\xdb\\x11\\x90\\x19\\x0cS\\x1b\\xbb\r\\\\x7f\\xba\\xdd\\xc7\\xdc\\x1b\\xf06\\xaa\\x06\\xc3\\xaa'\\x9b\\xe1~\\xea"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 275,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 276,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,580",
        "eid": 277,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,674",
        "eid": 278,
        "data": {
          "file": "mscoree.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 279,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 280,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 281,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 282,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 283,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 284,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 285,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 286,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 287,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 288,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 289,
        "data": {
          "file": "MSVCRT.DLL",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 290,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 291,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 292,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 293,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:48,690",
        "eid": 294,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,775",
        "eid": 295,
        "data": {
          "file": "C:\\Windows\\System32\\es.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8e940000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,775",
        "eid": 296,
        "data": {
          "file": "C:\\Windows\\System32\\es.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8e940000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,806",
        "eid": 297,
        "data": {
          "file": "API-MS-Win-Security-Base-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,806",
        "eid": 298,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,806",
        "eid": 299,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82a50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,822",
        "eid": 300,
        "data": {
          "file": "authZ.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95060000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,822",
        "eid": 301,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fc20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,837",
        "eid": 302,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wmiutils.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8be60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,853",
        "eid": 303,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\repdrvfs.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fab0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,853",
        "eid": 304,
        "data": {
          "file": "Wevtapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff905b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 305,
        "data": {
          "file": "amsi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 306,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 307,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 308,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 309,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 310,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 311,
        "data": {
          "file": "C:\\Windows\\System32\\version.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff853a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,009",
        "eid": 312,
        "data": {
          "file": "C:\\Program Files\\Windows Defender\\MpOAV.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d4d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 313,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\WmiPrvSD.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff3a940000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 314,
        "data": {
          "file": "API-MS-Win-Security-Base-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 315,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 316,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 317,
        "data": {
          "file": "api-ms-win-core-processsecurity-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 318,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemess.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff590a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 319,
        "data": {
          "file": "C:\\Windows\\System32\\rsaenh.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95330000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 320,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,025",
        "eid": 321,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\esscli.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fba0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,665",
        "eid": 322,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,072",
        "eid": 323,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,244",
        "eid": 324,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,275",
        "eid": 325,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,400",
        "eid": 326,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,494",
        "eid": 327,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:47,775",
        "eid": 328,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\NCProv.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fb70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:52,947",
        "eid": 329,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,790",
        "eid": 330,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,822",
        "eid": 331,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemcore.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff56920000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,508",
        "eid": 332,
        "data": {
          "file": "MSVCRT.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7fff98030000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,508",
        "eid": 333,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,508",
        "eid": 334,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,524",
        "eid": 335,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,524",
        "eid": 336,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,524",
        "eid": 337,
        "data": {
          "file": "LPK",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,524",
        "eid": 338,
        "data": {
          "file": "GDI32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,555",
        "eid": 339,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,555",
        "eid": 340,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,586",
        "eid": 341,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 342,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff93cf0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 343,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 344,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 345,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 346,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 347,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 348,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 349,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 350,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,602",
        "eid": 351,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 352,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 353,
        "data": {
          "file": "user32",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 354,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Session Manager\\ResourcePolicies",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 355,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 356,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 357,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 358,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 359,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,618",
        "eid": 360,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Control Panel\\Desktop\\SmoothScroll",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 361,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\EnableBalloonTips",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 362,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewAlphaSelect",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 363,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ListviewShadow",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 364,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AccListViewV6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 365,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\UseDoubleClickTimer",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 366,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 367,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 368,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 369,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 370,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 371,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,633",
        "eid": 372,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,649",
        "eid": 373,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\Disable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,649",
        "eid": 374,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\DataStore_V1.0\\DataFilePath",
          "content": "C:\\Windows\\Fonts\\staticcache.dat"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:31:59,649",
        "eid": 375,
        "data": {
          "file": "C:\\Windows\\Fonts\\StaticCache.dat"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 376,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane1",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 377,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane2",
          "content": "SimSun-ExtB"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 378,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane3",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 379,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane4",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 380,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane5",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 381,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane6",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 382,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane7",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 383,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane8",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 384,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane9",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 385,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane10",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 386,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane11",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 387,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane12",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 388,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane13",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 389,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane14",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 390,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane15",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 391,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\LanguagePack\\SurrogateFallback\\Plane16",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,664",
        "eid": 392,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 393,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 394,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 395,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 396,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 397,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes\\Segoe UI",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 398,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 399,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 400,
        "data": {
          "file": "comctl32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 401,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,680",
        "eid": 402,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SideBySide\\PreferExternalManifest",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 403,
        "data": {
          "file": "comctl32",
          "pathtofile": null,
          "moduleaddress": "0x7fff82ed0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 404,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 405,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 406,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\TurnOffSPIAnimations",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 407,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 408,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\LaunchUserOOBE",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,696",
        "eid": 409,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 410,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\CTF\\EnableAnchorContext",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 411,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 412,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-window-ext-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 413,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 414,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 415,
        "data": {
          "file": "ext-ms-win-rtcore-ntuser-integration-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 416,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 417,
        "data": {
          "file": "api-ms-win-core-com-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96ff0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 418,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 419,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,711",
        "eid": 420,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows\\IsVailContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 421,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\ResyncResetTime",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 422,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Input\\MaxResyncAttempts",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 423,
        "data": {
          "file": "iertutil.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 424,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 425,
        "data": {
          "file": "C:\\Windows\\System32\\msctf.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97f00000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 426,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 427,
        "data": {
          "file": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,727",
        "eid": 428,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,743",
        "eid": 429,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,805",
        "eid": 430,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82a50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,821",
        "eid": 431,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:31:59,821",
        "eid": 432,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,039",
        "eid": 433,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fc20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,039",
        "eid": 434,
        "data": {
          "file": "amsi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d520000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 435,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 436,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 437,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 438,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 439,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 440,
        "data": {
          "file": "C:\\Windows\\System32\\version.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff853a0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 441,
        "data": {
          "file": "C:\\Program Files\\Windows Defender\\MpOAV.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d4d0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 442,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
          "content": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 443,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 444,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 445,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 446,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 447,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 448,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 449,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 450,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 451,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,055",
        "eid": 452,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,071",
        "eid": 453,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,071",
        "eid": 454,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,071",
        "eid": 455,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,071",
        "eid": 456,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,071",
        "eid": 457,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,071",
        "eid": 458,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:00,071",
        "eid": 459,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,149",
        "eid": 460,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,149",
        "eid": 461,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,149",
        "eid": 462,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\SystemSKU",
          "content": "SKU"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,164",
        "eid": 463,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMajorRelease",
          "content": "255"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,164",
        "eid": 464,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\BIOS\\ECFirmwareMinorRelease",
          "content": "255"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,164",
        "eid": 465,
        "data": {
          "file": "C:\\Windows\\System32\\fveapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8d860000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,164",
        "eid": 466,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,180",
        "eid": 467,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,180",
        "eid": 468,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,180",
        "eid": 469,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,227",
        "eid": 470,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,274",
        "eid": 471,
        "data": {
          "file": "fveapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8d860000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,274",
        "eid": 472,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,274",
        "eid": 473,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,274",
        "eid": 474,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\PortableOperatingSystem",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,274",
        "eid": 475,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\HSTI\\HSTIVerificationRequired",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,305",
        "eid": 476,
        "data": {
          "file": "kernelbase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,305",
        "eid": 477,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,305",
        "eid": 478,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,368",
        "eid": 479,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker\\AutoDE\\CheckStatus"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,368",
        "eid": 480,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,368",
        "eid": 481,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\AutoDE\\CheckStatus\\HstiDmaLogged",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 482,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryption",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 483,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\BitLocker\\PreventDeviceEncryptionForAzureADJoinedDevices",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 484,
        "data": {
          "file": "reinfo.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fb70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 485,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 486,
        "data": {
          "file": "C:\\Windows\\System32\\Recovery\\ReAgent.xml"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 487,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimValidated",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 488,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Reliability\\WinRE\\WimHash",
          "content": "\\x01\\xec\\xce\\xdbE\\xdb\\x11\\x90\\x19\\x0cS\\x1b\\xbb\r\\\\x7f\\xba\\xdd\\xc7\\xdc\\x1b\\xf06\\xaa\\x06\\xc3\\xaa'\\x9b\\xe1~\\xea"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 489,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 490,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,383",
        "eid": 491,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,289",
        "eid": 492,
        "data": {
          "file": "mscoree.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 493,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 494,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 495,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 496,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 497,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 498,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 499,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 500,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 501,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 502,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,305",
        "eid": 503,
        "data": {
          "file": "MSVCRT.DLL",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,321",
        "eid": 504,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,321",
        "eid": 505,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:03,321",
        "eid": 506,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableMetaFiles",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:03,321",
        "eid": 507,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\GRE_Initialize\\DisableUmpdBufferSizeCheck",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:03,321",
        "eid": 508,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,672",
        "eid": 509,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,672",
        "eid": 510,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,672",
        "eid": 511,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82a50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,688",
        "eid": 512,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fc20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,688",
        "eid": 513,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wmiutils.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8be60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,719",
        "eid": 514,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\cimwin32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff3a730000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,719",
        "eid": 515,
        "data": {
          "file": "wldp.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95ca0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,719",
        "eid": 516,
        "data": {
          "file": "wldp.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95ca0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,719",
        "eid": 517,
        "data": {
          "file": "wldp.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95ca0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,719",
        "eid": 518,
        "data": {
          "file": "wldp.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95ca0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,735",
        "eid": 519,
        "data": {
          "file": "SECURITY.DLL",
          "pathtofile": null,
          "moduleaddress": "0x1bf1fc80000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,735",
        "eid": 520,
        "data": {
          "file": "C:\\Windows\\System32\\schannel.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95240000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,735",
        "eid": 521,
        "data": {
          "file": "NTDLL.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7fff98c50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,751",
        "eid": 522,
        "data": {
          "file": "NETAPI32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7fff85400000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,751",
        "eid": 523,
        "data": {
          "file": "wkscli.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff95490000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,751",
        "eid": 524,
        "data": {
          "file": "cscapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82eb0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,782",
        "eid": 525,
        "data": {
          "file": "KERNEL32.DLL",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,782",
        "eid": 526,
        "data": {
          "file": "OLEAUT32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff980d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,797",
        "eid": 527,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98c50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,797",
        "eid": 528,
        "data": {
          "file": "DEVOBJ.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96050000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,797",
        "eid": 529,
        "data": {
          "file": "WMI.DLL",
          "pathtofile": null,
          "moduleaddress": "0x1bf1fcc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:00,813",
        "eid": 530,
        "data": {
          "file": "POWRPROF.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96190000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,219",
        "eid": 531,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\ntevt.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d0b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,235",
        "eid": 532,
        "data": {
          "file": "tzres.dll",
          "pathtofile": null,
          "moduleaddress": "0x1bf1fce0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,266",
        "eid": 533,
        "data": {
          "file": "C:\\Windows\\System32\\Win32_DeviceGuard.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8be10000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,282",
        "eid": 534,
        "data": {
          "file": "C:\\Windows\\System32\\wmitomi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff59060000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,282",
        "eid": 535,
        "data": {
          "file": "API-MS-Win-Core-LocalRegistry-L1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,485",
        "eid": 536,
        "data": {
          "file": "tzres.dll",
          "pathtofile": null,
          "moduleaddress": "0x1bf1fce0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 537,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\Sink Transmit Buffer Size",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 538,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\DefaultRpcStackSize",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 539,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 540,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 541,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 542,
        "data": {
          "file": "USER32",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 543,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 544,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,048",
        "eid": 545,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 546,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 547,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 548,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 549,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 550,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 551,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 552,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 553,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82dc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 554,
        "data": {
          "file": "wmisvc.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 555,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wbemsvc.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82a50000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 556,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D4781CD6-E5D3-44DF-AD94-930EFE48A887}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,064",
        "eid": 557,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9F6C78EF-FCE5-42FA-ABEA-3E7DF91921DC}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 558,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 559,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 560,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 561,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 562,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 563,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 564,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 565,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 566,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9556DC99-828C-11CF-A37E-00AA003240C7}\\ProxyStubClsid32\\(Default)",
          "content": "{D68AF00A-29CB-43FA-8504-CE99A996D9EA}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 567,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 568,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 569,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 570,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 571,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 572,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 573,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 574,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 575,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 576,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IWbemServices"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 577,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 578,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 579,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 580,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 581,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 582,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\fastprox.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7fc20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 583,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 584,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 585,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Wbem\\CIMOM\\EnableObjectValidation",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 586,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 587,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 588,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{73E709EA-5D93-4B2E-BBB0-99B7938DA9E4}\\(Default)",
          "content": "Microsoft WMI Provider Subsystem Host"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,079",
        "eid": 589,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B7B31DF9-D515-11D3-A11C-00105A1F515A}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 590,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{07435309-D440-41B7-83F3-EB82DB6C622F}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 591,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{21CD80A2-B305-4F37-9D4C-4534A8D9B568}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 592,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{06413D98-405C-4A5A-8D6F-19B8B7C6ACF7}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 593,
        "data": {
          "file": "C:\\Windows\\System32\\wbem\\wmiutils.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8be60000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 594,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\(Default)",
          "content": "C:\\Windows\\System32\\wbem\\WmiPerfClass.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 595,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 596,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\Synchronization",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 597,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\InprocServer32\\(Default)",
          "content": "C:\\Windows\\System32\\wbem\\WmiPerfClass.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 598,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\(Default)",
          "content": "WmiPerf Class Provider"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 599,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{661FF7F6-F4D1-4593-B59D-4C54C1ECE68B}\\AppId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,095",
        "eid": 600,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{027947E1-D731-11CE-A357-000000000001}\\ProxyStubClsid32\\(Default)",
          "content": "{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 601,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 602,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 603,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 604,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 605,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 606,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 607,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 608,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 609,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 610,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\(Default)",
          "content": "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 611,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 612,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 613,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\wbem\\fastprox.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 614,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\InprocServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 615,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 616,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{1C1C45EE-4395-11D2-B60B-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:01,111",
        "eid": 617,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{423EC01E-2E35-11D2-B604-00104B703EFD}\\ProxyStubClsid32\\(Default)",
          "content": "{7C857801-7381-11CF-884D-00AA004B2E24}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 618,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-2",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 619,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 620,
        "data": {
          "file": "bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96c20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 621,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 622,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 623,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 624,
        "data": {
          "file": "kernel32",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 625,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 626,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 627,
        "data": {
          "file": "api-ms-win-core-string-l1-1-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 628,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 629,
        "data": {
          "file": "api-ms-win-core-datetime-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,343",
        "eid": 630,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 631,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 632,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 633,
        "data": {
          "file": "bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96c20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 634,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 635,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 636,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 637,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\Clients\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\channel",
          "content": "stable"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 638,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\ap",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 639,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 640,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\EdgeUpdate\\ClientState\\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\\cohort\\name",
          "content": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 641,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 642,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 643,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 644,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 645,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 646,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 647,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 648,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 649,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 650,
        "data": {
          "file": "api-ms-win-core-file-l1-2-1.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,359",
        "eid": 651,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 652,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-2",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 653,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 654,
        "data": {
          "file": "bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96c20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 655,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 656,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 657,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 658,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 659,
        "data": {
          "file": "kernel32",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 660,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 661,
        "data": {
          "file": "api-ms-win-core-string-l1-1-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 662,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 663,
        "data": {
          "file": "api-ms-win-core-datetime-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 664,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 665,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 666,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 667,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 668,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 669,
        "data": {
          "file": "api-ms-win-downlevel-shell32-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff984b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 670,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 671,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 672,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 673,
        "data": {
          "file": "bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96c20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,484",
        "eid": 674,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,500",
        "eid": 675,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 676,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-2",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 677,
        "data": {
          "file": "bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96c20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 678,
        "data": {
          "file": "api-ms-win-core-localization-l1-2-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 679,
        "data": {
          "file": "kernel32",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 680,
        "data": {
          "file": "api-ms-win-core-string-l1-1-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 681,
        "data": {
          "file": "api-ms-win-core-datetime-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 682,
        "data": {
          "file": "api-ms-win-core-localization-obsolete-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 683,
        "data": {
          "file": "bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96c20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 684,
        "data": {
          "file": "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge.dll",
          "pathtofile": null,
          "moduleaddress": "0x24ac5000000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 685,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 686,
        "data": {
          "file": "ucrtbase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 687,
        "data": {
          "file": "ADVAPI32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff983c0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 688,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 689,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff93cf0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 690,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 691,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
          "content": "1"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,515",
        "eid": 692,
        "data": {
          "file": "Kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 693,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 694,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 695,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 696,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 697,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\OEM\\DeviceForm",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 698,
        "data": {
          "file": "USER32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97d60000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 699,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 700,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 701,
        "data": {
          "file": "api-ms-win-core-wow64-l1-1-1.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 702,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\UBR",
          "content": "3803"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 703,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\DisplayVersion",
          "content": "22H2"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,531",
        "eid": 704,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 705,
        "data": {
          "file": "Kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 706,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 707,
        "data": {
          "file": "shell32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff97610000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 708,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 709,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 710,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 711,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 712,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 713,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 714,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 715,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 716,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 717,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 718,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 719,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 720,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 721,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 722,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 723,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 724,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 725,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 726,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,546",
        "eid": 727,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 728,
        "data": {
          "file": "api-ms-win-core-winrt-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96ff0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 729,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 730,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 731,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 732,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 733,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 734,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 735,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 736,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 737,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 738,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 739,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 740,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 741,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 742,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 743,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 744,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 745,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 746,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 747,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 748,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 749,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 750,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 751,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\DllPath",
          "content": "C:\\Windows\\System32\\execmodelclient.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 752,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 753,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 754,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 755,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 756,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 757,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 758,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 759,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundExecutionManager\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,562",
        "eid": 760,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 761,
        "data": {
          "file": "C:\\Windows\\System32\\execmodelclient.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff84d00000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 762,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 763,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 764,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 765,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\DllPath",
          "content": "C:\\Windows\\System32\\combase.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 766,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 767,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 768,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 769,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 770,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 771,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 772,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 773,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Diagnostics.AsyncCausalityTracer\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 774,
        "data": {
          "file": "C:\\Windows\\System32\\combase.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96ff0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 775,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 776,
        "data": {
          "file": "ole32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff985b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 777,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 778,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 779,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 780,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\DllPath",
          "content": "C:\\Windows\\System32\\wpnapps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 781,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Threading",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 782,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 783,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 784,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 785,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 786,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 787,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 788,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\Permissions",
          "content": "\\x01\\x00\\x14\\x80$\\x01\\x00\\x000\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\xf4\\x00\\x07\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x0b\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 789,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Notifications.ToastNotificationManager\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 790,
        "data": {
          "file": "C:\\Windows\\System32\\wpnapps.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82770000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 791,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 792,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 793,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 794,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 795,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 796,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 797,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\DefaultAccessPermission",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 798,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,578",
        "eid": 799,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 800,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 801,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{E1CDD77A-65D3-4db0-B339-21F6A48CC2FF}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 802,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000035-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 803,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AF86E2E0-B12D-4c6a-9C5A-D7AA65101E90}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 804,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{50ac103f-d235-4598-bbef-98fe4d1a3ad4}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 805,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 806,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\(Default)",
          "content": "Windows Push Notification Developer Proxy Stub"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 807,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 808,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)",
          "content": "ExecModelProxy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 809,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 810,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 811,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 812,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)",
          "content": "%SystemRoot%\\System32\\wpnapps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 813,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 814,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)",
          "content": "%SystemRoot%\\System32\\wpnapps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 815,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\execmodelproxy.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 816,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 817,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\execmodelproxy.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 818,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 819,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 820,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 821,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 822,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\(Default)",
          "content": "ExecModelProxy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 823,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 824,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 825,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 826,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\execmodelproxy.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 827,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\InprocServer32\\(Default)",
          "content": "%systemroot%\\system32\\execmodelproxy.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 828,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 829,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{b03c2205-f02e-4d77-80df-e1747afdd39c}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 830,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7ab93c52-0e48-4750-ba9d-1a4113981847}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 831,
        "data": {
          "file": "C:\\Windows\\System32\\execmodelproxy.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff833f0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 832,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 833,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5caddc63-01d3-4c97-986f-0533483fee14}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,593",
        "eid": 834,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bc3d253-2f31-4092-9129-8ad5abf067da}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 835,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 836,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname",
          "content": "LetAppsRunInBackground_UserInControlOfTheseApps"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 837,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 838,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath",
          "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 839,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 840,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 841,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 842,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior",
          "content": "139296"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 843,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 844,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 845,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 846,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 847,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname",
          "content": "LetAppsRunInBackground_ForceAllowTheseApps"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 848,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 849,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath",
          "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 850,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 851,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 852,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 853,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 854,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 855,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 856,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 857,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 858,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior",
          "content": "139296"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 859,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 860,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 861,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 862,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 863,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname",
          "content": "LetAppsRunInBackground_ForceDenyTheseApps"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 864,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 865,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 866,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 867,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 868,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{0c9281f9-6da1-4006-8729-de6e6b61581c}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 869,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 870,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior",
          "content": "139296"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 871,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 872,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 873,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 874,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 875,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname",
          "content": "LetAppsRunInBackground"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 876,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Containers\\WaitForRestore",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 877,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 878,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 879,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 880,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 881,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 882,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 883,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Server",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 884,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 885,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 886,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 887,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 888,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 889,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 890,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 891,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 892,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.User\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 893,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 894,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\CommandLine",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 895,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\IdentityType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 896,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 897,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 898,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\Permissions",
          "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 899,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ActivatableClasses",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 900,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF8E9480-CA73-448E-B8F0-DA000F581428}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 901,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServerType",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 902,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\AppId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 903,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ServiceName",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 904,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\StateRepository\\ExplicitPsmActivationType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 905,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 906,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 907,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 908,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 909,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 910,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 911,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 912,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84103ccb-2fd7-4d6c-962e-5d8582b4c720}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 913,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 914,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 915,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 916,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 917,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 918,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 919,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 920,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 921,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 922,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 923,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 924,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 925,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 926,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 927,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\\\Windows.StateRepositoryPS.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 928,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 929,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{c53e07ec-25f3-4093-aa39-fc67ea22e99d}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 930,
        "data": {
          "file": "C:\\Windows\\System32\\OneCoreUAPCommonProxyStub.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8f850000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 931,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 932,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.StateRepositoryPS.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8b820000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,609",
        "eid": 933,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 934,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DCAEE35A-508D-4419-9E56-50D658C2C812}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 935,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5232f8ea-49c7-4840-bfbb-66e785689e88}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 936,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 937,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Server",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 938,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 939,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 940,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 941,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 942,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 943,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 944,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 945,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 946,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Package\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 947,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{0450ce77-af0d-40ac-93fd-1e5d48c89419}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 948,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{195f5943-0c04-4eab-b907-735817fdac77}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 949,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{a819f3de-60aa-5159-8407-f0a7fb1f6832}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 950,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{D6F5F569-D40D-407C-8989-88CAB42CFD14}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 951,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{79ab57f6-43fe-487b-8a7f-99567200ae94}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 952,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 953,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\Software\\Microsoft\\SecurityManager\\CapAuthz\\HasRepaired\\VolatileChildTest"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 954,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 955,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 956,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 957,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids",
          "content": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 958,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 959,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 960,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{F655B052-348B-4AB0-947B-A7DAFA44D404}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 961,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\PolicyType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 962,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Behavior",
          "content": "139296"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 963,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\MergeAlgorithm",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 964,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 965,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 966,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 967,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicyname",
          "content": "LetAppsRunInBackground_UserInControlOfTheseApps"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 968,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 969,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicypath",
          "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 970,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\grouppolicymultiszSeparatorChar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 971,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 972,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 973,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 974,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{58058629-16A1-438A-90C8-7E954B3734B1}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 975,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 976,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_UserInControlOfTheseApps\\Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 977,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\PolicyType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 978,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Behavior",
          "content": "139296"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 979,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\MergeAlgorithm",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 980,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 981,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 982,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 983,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyname",
          "content": "LetAppsRunInBackground_ForceAllowTheseApps"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 984,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 985,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicypath",
          "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 986,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicyismultisz",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 987,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\grouppolicymultiszSeparatorChar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 988,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 989,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 990,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 991,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 992,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceAllowTheseApps\\Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 993,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\PolicyType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 994,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Behavior",
          "content": "139296"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 995,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\MergeAlgorithm",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 996,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 997,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 998,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 999,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyname",
          "content": "LetAppsRunInBackground_ForceDenyTheseApps"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1000,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1001,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicypath",
          "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1002,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicyismultisz",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1003,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\grouppolicymultiszSeparatorChar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1004,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1005,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1006,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1007,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1008,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground_ForceDenyTheseApps\\Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1009,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\PolicyType",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1010,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Behavior",
          "content": "139296"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1011,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\MergeAlgorithm",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1012,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1013,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1014,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1015,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyname",
          "content": "LetAppsRunInBackground"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1016,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1017,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicypath",
          "content": "Software\\Policies\\Microsoft\\Windows\\AppPrivacy"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1018,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicyismultisz",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1019,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\grouppolicymultiszSeparatorChar",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1020,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1021,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1022,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1023,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1024,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Privacy\\LetAppsRunInBackground\\Value",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1025,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1026,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\AppPackageType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1027,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1028,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\PackageSid",
          "content": "S-1-15-2-543634040-274359014-2226501544-3561766748-3991453649-3543631192-522786984"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1029,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1030,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\CapSids",
          "content": "\\x03\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\x93MhQ\\x18=\\xc3\\xa6(\\x927f\\xc7\\xb1\\xfd\\x1eb\\x11\\xb0\\x8dT\\xad@A8\\xb7l\\xebv\\xc0V\\xd6\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xdc\\xdc\\xc7+\\x1b\\x84\\xfb\\x17\\x8c\\xfd\\xd5\\x99\\x9fj\\xa1T\\xc3\t\\x1a\\xfbT\\xa8\\x98\\xa2\\x98\\xef\\x9b\r\\xe1=\\xaa!\\x01\\x08\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00x2g \\xe6bZ\\x10\\xa8\\xb7\\xb5\\x84\\?L\\xd4\\xd1\\xbf\\xe8\\xedX\\x857\\xd3\\xa8\\x18)\\x1f\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1031,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1032,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\CapAuthz\\ApplicationsEx\\Microsoft.MicrosoftEdge.Stable_148.0.3967.83_neutral__8wekyb3d8bbwe\\ApplicationFlags",
          "content": "0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1033,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98c50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1034,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1035,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1036,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1037,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1038,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,625",
        "eid": 1039,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1821FE-179D-49BC-B79D-A527920D3665}\\ProxyStubClsid32\\(Default)",
          "content": "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1040,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1041,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1042,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1043,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\DllPath",
          "content": "C:\\Windows\\System32\\biwinrt.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1044,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1045,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1046,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1047,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1048,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1049,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1050,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1051,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundTaskRegistration\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1052,
        "data": {
          "file": "C:\\Windows\\System32\\biwinrt.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d640000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1053,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1054,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1055,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1056,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\DllPath",
          "content": "C:\\Windows\\System32\\biwinrt.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1057,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Threading",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1058,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1059,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1060,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1061,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1062,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1063,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1064,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Background.BackgroundWorkManager\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1065,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{350E1244-4575-45EE-8595-0AA8C6506FC7}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1066,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{01CF8BD4-E3D6-413D-8339-36D46E78D12C}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1067,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1068,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1069,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1070,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1071,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1072,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1073,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1074,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1075,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1076,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1077,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.ValueSet\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1078,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C5543B33-5C73-4DC5-9211-24077D3B06C5}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1079,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1080,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1081,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1082,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1083,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1084,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1085,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1086,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1087,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataWriter\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1088,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1089,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1090,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1091,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1092,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1093,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1094,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1095,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1096,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1097,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1098,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.Streams.DataReader\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1099,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1100,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1101,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1102,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1103,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1104,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1105,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1106,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1107,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1108,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1109,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1110,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2C08602F-40B1-5E97-AE21-5C04D7FB829C}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1111,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{62AE0FDA-B238-554F-A275-1DC16D6CA03A}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,640",
        "eid": 1112,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8445D2AE-DD03-5B98-95E4-82B43A3F0D64}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1113,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9BCB843B-221B-5FBE-9B20-7028BC4E8653}\\ProxyStubClsid32\\(Default)",
          "content": "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1114,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1115,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1116,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1117,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1118,
        "data": {
          "file": "api-ms-win-downlevel-shell32-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff984b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1119,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1120,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1121,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1122,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\DllPath",
          "content": "C:\\Windows\\System32\\Windows.ApplicationModel.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1123,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1124,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1125,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1126,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1127,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1128,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1129,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1130,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.LimitedAccessFeatures\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1131,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1132,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1133,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.ApplicationModel.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff85060000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1134,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1135,
        "data": {
          "file": "C:\\Windows\\System32\\bcryptprimitives.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff96c20000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1136,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1137,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1138,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1139,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\(Default)",
          "content": "04c19204-10d9-450a-95c4-2910c8f72be3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1140,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1141,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1142,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\DllPath",
          "content": "C:\\Windows\\System32\\CryptoWinRT.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1143,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1144,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1145,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1146,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1147,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1148,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1149,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1150,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.CryptographicBuffer\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1151,
        "data": {
          "file": "C:\\Windows\\System32\\CryptoWinRT.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff70d80000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1152,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1153,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1154,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1155,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\DllPath",
          "content": "C:\\Windows\\System32\\CryptoWinRT.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1156,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1157,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1158,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1159,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1160,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1161,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1162,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1163,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmNames\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1164,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1165,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1166,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\DllPath",
          "content": "C:\\Windows\\System32\\CryptoWinRT.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1167,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1168,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1169,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1170,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1171,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1172,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1173,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1174,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Security.Cryptography.Core.HashAlgorithmProvider\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1175,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\LimitedAccessFeatures\\com.microsoft.windows.taskbar.requestPinSecondaryTile\\Expiration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1176,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1177,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1178,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\DllPath",
          "content": "C:\\Windows\\System32\\twinapi.appcore.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1179,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1180,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1181,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1182,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1183,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1184,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1185,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1186,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.ApplicationModel.Core.CoreApplication\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1187,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1188,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1189,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1190,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1191,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1192,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1193,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1194,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1195,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1196,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1197,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,656",
        "eid": 1198,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.Collections.PropertySet\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1199,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\XAML\\OneCoreTransformsEnabledByDefault",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1200,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1201,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1202,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1203,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\DllPath",
          "content": "C:\\Windows\\System32\\wpnapps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1204,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Threading",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1205,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1206,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1207,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateAsUser",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1208,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1209,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateInBrokerForMediumILContainer",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1210,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1211,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.SecondaryTile\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1212,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1213,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1214,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\DllPath",
          "content": "C:\\Windows\\System32\\TileDataRepository.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1215,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Threading",
          "content": "0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1216,
        "data": {
          "file": "api-ms-win-downlevel-shell32-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff984b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1217,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1218,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1219,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1220,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1221,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1222,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1223,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1224,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.SecondaryTileStore\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1225,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1226,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1227,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1228,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1229,
        "data": {
          "file": "C:\\Windows\\System32\\TileDataRepository.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82980000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1230,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1231,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1232,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1233,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1234,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Server",
          "content": "UserManager"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1235,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1236,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1237,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1238,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1239,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1240,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.Internal.UserManager\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1241,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1242,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\CommandLine",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1243,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1244,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\IdentityType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1245,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Permissions",
          "content": "\\x01\\x00\\x14\\x80d\\x00\\x00\\x00p\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x004\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1246,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ActivatableClasses",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1247,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1248,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServerType",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1249,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\AppId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1250,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity",
          "content": "nt authority\\system"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1251,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\Identity",
          "content": "nt authority\\system"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1252,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ServiceName",
          "content": "UserManager"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1253,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\Server\\UserManager\\ExplicitPsmActivationType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1254,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)",
          "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1255,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{252E7F79-ACFA-4EA2-9A7E-FA27A8A4D3D9}\\ProxyStubClsid32\\(Default)",
          "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1256,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1257,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1258,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)",
          "content": "Windows.System.User.ProxyStubFactory"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1259,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1260,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1261,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1262,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1263,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\usermgrproxy.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1264,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1265,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1266,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1267,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1268,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1269,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\usermgrproxy.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1270,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\(Default)",
          "content": "Windows.System.User.ProxyStubFactory"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1271,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1272,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1273,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1274,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\usermgrproxy.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1275,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{1BAC8681-2965-4FFC-92D1-170CA4099E01}\\AppID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1276,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1277,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Server",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1278,
        "data": {
          "file": "C:\\Windows\\System32\\usermgrproxy.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8ecc0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1279,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1280,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1281,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1282,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1283,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,671",
        "eid": 1284,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1285,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Storage.ApplicationData\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1286,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{100EB64B-B24C-4C38-8964-720D926D05A4}\\ProxyStubClsid32\\(Default)",
          "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1287,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.Storage.ApplicationData.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7c440000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1288,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1289,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DF9A26C6-E746-4BCD-B5D4-120103C4209B}\\ProxyStubClsid32\\(Default)",
          "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1290,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\SystemAppData\\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\\PSR\\WnfStateName",
          "content": "\\xe5\\xd0\\xbd\\xa3mN\\xc6A"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1291,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1292,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
          "content": "%USERPROFILE%\\AppData\\Local"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1293,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1294,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath",
          "content": "C:\\Users\\admin"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1295,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1296,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Server",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1297,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1298,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1299,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1300,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1301,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1302,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1303,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.SecondaryTileView\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1304,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1305,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{b3f72108-5c5c-469b-a5e5-3f64d2a39b01}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1306,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1307,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1308,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Server",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1309,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1310,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1311,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1312,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1313,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1314,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1315,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1316,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1317,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.Application\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1318,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1319,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{d81e96f1-a89c-417e-9335-59531026309d}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1320,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{3bed20a5-6dee-4297-b976-3b30df69a7aa}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1321,
        "data": {
          "file": "api-ms-win-eventing-provider-l1-1-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1322,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,687",
        "eid": 1323,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7f290da0-75e3-5885-898d-1f5b1ed47ed2}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1324,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesMyComputer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1325,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoPropertiesRecycleBin",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1326,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1327,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1328,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{efe869fc-5841-55f1-aa56-82c7219aaa09}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1329,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9ed07b24-36fd-543b-948e-b01fe5814b49}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1330,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoControlPanel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1331,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoSetFolders",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1332,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoInternetIcon",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1333,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\ValidateRegItems",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1334,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Desktop\\NameSpace\\MonitorRegistry",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1335,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoCommonGroups",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1336,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\Attributes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1337,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\CallForAttributes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1338,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\RestrictedAttributes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1339,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\ShellFolder\\FolderValueFlags",
          "content": "1581568"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1340,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\NonEnum\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1341,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\ValidateRegItems",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1342,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MyComputer\\NameSpace\\MonitorRegistry",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1343,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1344,
        "data": {
          "file": "C:\\Windows\\System32\\mssprxy.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8a550000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,703",
        "eid": 1345,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF50}\\ProxyStubClsid32\\(Default)",
          "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1346,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{AB310581-AC80-11D1-8DF3-00C04FB6EF55}\\ProxyStubClsid32\\(Default)",
          "content": "{A5EBA07A-DAE8-4d15-B12F-728EFD8A9866}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1347,
        "data": {
          "file": "C:\\Windows\\System32\\propsys.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff91eb0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1348,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1349,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1350,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Local AppData",
          "content": "%USERPROFILE%\\AppData\\Local"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1351,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1352,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\S-1-5-21-3968686040-3210279463-847977608-1001\\ProfileImagePath",
          "content": "C:\\Users\\admin"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1353,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1354,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1355,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,718",
        "eid": 1356,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Appx\\PackageRepositoryRoot",
          "content": "C:\\ProgramData\\Microsoft\\Windows\\AppRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1357,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00&\\x00\\xbc\\x12\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1358,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1359,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1360,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\DontShowSuperHidden",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1361,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1362,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellState",
          "content": "$\\x00\\x00\\x004(\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x13\\x00\\x00\\x00\\x00\\x00\\x00\\x00b\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1363,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\NoWebView",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1364,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\ClassicShell",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1365,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\SeparateProcess",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1366,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Hidden",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1367,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowCompColor",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1368,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideFileExt",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1369,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\DontPrettyPath",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1370,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowInfoTip",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1371,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\HideIcons",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1372,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\MapNetDrvBtn",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1373,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\WebView",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1374,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Filter",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1375,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowSuperHidden",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1376,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\SeparateProcess",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1377,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\NoNetCrawling",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1378,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\AutoCheckSelect",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1379,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\IconsOnly",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1380,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\ShowStatusBar",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1381,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00R\\xbd\\xbb\\x88\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x001\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1382,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1383,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\DocObject",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1384,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xbaA\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00&\\x00\\xbc\\x12\\x1f\\x00\\x00\\x00\\x04@\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x003\\x003\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1385,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1386,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\IsShortcut",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,734",
        "eid": 1387,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\Software\\Classes\\Directory\\AlwaysShowExt",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1388,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x08\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\xff\\x06\\xe7\\x03\\xff\\x00\\x00\\x00\\x16\\x00\\x00\\x00\\x9d\\x7f\\xd7`\\x1e\\x00\\x00\\x00\\x04\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00T\\x00O\\x00R\\x00A\\x00G\\x00E\\x00#\\x00V\\x00o\\x00l\\x00u\\x00m\\x00e\\x00#\\x00{\\x00e\\x003\\x002\\x00a\\x009\\x004\\x004\\x002\\x00-\\x005\\x00a\\x00f\\x002\\x00-\\x001\\x001\\x00f\\x001\\x00-\\x00a\\x00e\\x002\\x00c\\x00-\\x008\\x000\\x006\\x00e\\x006\\x00f\\x006\\x00e\\x006\\x009\\x006\\x003\\x00}\\x00#\\x000\\x000\\x000\\x000\\x000\\x000\\x000\\x00E\\x00D\\x00D\\x00C\\x000\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1389,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1390,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Folder\\NeverShowExt",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1391,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AllFilesystemObjects\\NeverShowExt",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1392,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Data",
          "content": "\\xd6\r\\x00\\x00\r\\xf0\\xad\\xba\\x01\\x00\\x00\\x00\\x10\\x00\\x00\\x00\\x00\\x00\\x00\\x80\\x00\\x00\\x00\\x00\\x00\\x00\\x000\\x00\\x00\\x00\\x80#\\x00\\x00\\x00\\x07\\x02H\\x01\\xfe\\x00\\x00\\x00\\x11\\x00\\x00\\x00x\\x00'\\xca\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x0b\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\\\x00\\\\x00?\\x00\\\\x00S\\x00C\\x00S\\x00I\\x00#\\x00C\\x00d\\x00R\\x00o\\x00m\\x00&\\x00V\\x00e\\x00n\\x00_\\x00<\\x00W\\x00O\\x00O\\x00T\\x00>\\x00&\\x00P\\x00r\\x00o\\x00d\\x00_\\x00H\\x00L\\x00-\\x00P\\x00Q\\x00-\\x00S\\x00V\\x00_\\x00W\\x00B\\x008\\x00#\\x004\\x00&\\x003\\x005\\x004\\x002\\x004\\x008\\x006\\x007\\x00&\\x000\\x00&\\x000\\x001\\x000\\x000\\x000\\x000\\x00#\\x00{\\x005\\x003\\x00f\\x005\\x006\\x003\\x000\\x00d\\x00-\\x00b\\x006\\x00b\\x00f\\x00-\\x001\\x001\\x00d\\x000\\x00-\\x009\\x004\\x00f\\x002\\x00-\\x000\\x000\\x00a\\x000\\x00c\\x009\\x001\\x00e\\x00f\\x00b\\x008\\x00b\\x00}\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1393,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Generation",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1394,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Category",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1395,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Name",
          "content": "Start Menu"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1396,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParentFolder",
          "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1397,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Description",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1398,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\RelativePath",
          "content": "Microsoft\\Windows\\Start Menu"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1399,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\ParsingName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1400,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InfoTip",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1401,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalizedName",
          "content": "@%SystemRoot%\\system32\\shell32.dll,-21786"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1402,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Icon",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1403,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Security",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1404,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResource",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1405,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\StreamResourceType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1406,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\LocalRedirectOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1407,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Roamable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1408,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PreCreate",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1409,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Stream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1410,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\PublishExpandedPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1411,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\DefinitionFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1412,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\Attributes",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1413,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\FolderTypeID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1414,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{625B53C3-AB48-4EC1-BA1F-A1EF4146FC19}\\InitFolderHandler",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1415,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Start Menu",
          "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1416,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Category",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1417,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Name",
          "content": "Common Start Menu"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1418,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParentFolder",
          "content": "{62AB5D82-FDC1-4DC3-A9DD-070D1D495D97}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1419,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Description",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1420,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\RelativePath",
          "content": "Microsoft\\Windows\\Start Menu"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1421,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\ParsingName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1422,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InfoTip",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1423,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalizedName",
          "content": "@%SystemRoot%\\system32\\shell32.dll,-21786"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1424,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Icon",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1425,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Security",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1426,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResource",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1427,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\StreamResourceType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1428,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\LocalRedirectOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1429,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Roamable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1430,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PreCreate",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1431,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Stream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1432,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\PublishExpandedPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1433,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\DefinitionFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1434,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\Attributes",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1435,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\FolderTypeID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1436,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{A4115719-D62E-491D-AA7C-E74B8BE3B067}\\InitFolderHandler",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1437,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Common Start Menu",
          "content": "%ProgramData%\\Microsoft\\Windows\\Start Menu"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1438,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Category",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1439,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Name",
          "content": "Recent"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1440,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParentFolder",
          "content": "{3EB685DB-65F9-4CF6-A03A-E3EF65729F3D}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1441,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Description",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1442,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\RelativePath",
          "content": "Microsoft\\Windows\\Recent"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1443,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\ParsingName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1444,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InfoTip",
          "content": "@shell32,dll,-12692"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1445,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalizedName",
          "content": "@%SystemRoot%\\system32\\shell32.dll,-21797"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1446,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Icon",
          "content": "%SystemRoot%\\system32\\imageres.dll,-117"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1447,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Security",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1448,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResource",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1449,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\StreamResourceType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1450,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\LocalRedirectOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1451,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Roamable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1452,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PreCreate",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1453,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Stream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1454,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\PublishExpandedPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1455,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\DefinitionFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1456,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\Attributes",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1457,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\FolderTypeID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1458,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{AE50C081-EBD2-438A-8655-8A092E34987A}\\InitFolderHandler",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1459,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Recent",
          "content": "%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1460,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Category",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1461,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Name",
          "content": "Windows"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1462,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParentFolder",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1463,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Description",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1464,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\RelativePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1465,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\ParsingName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1466,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InfoTip",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1467,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalizedName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1468,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Icon",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1469,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Security",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1470,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResource",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1471,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\StreamResourceType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1472,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\LocalRedirectOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1473,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Roamable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1474,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PreCreate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1475,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Stream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1476,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\PublishExpandedPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1477,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\DefinitionFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1478,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\Attributes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1479,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\FolderTypeID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1480,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{F38BF404-1D43-42F2-9305-67DE0B28FC23}\\InitFolderHandler",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1481,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Category",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1482,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Name",
          "content": "System"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1483,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParentFolder",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1484,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Description",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1485,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\RelativePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1486,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\ParsingName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1487,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InfoTip",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1488,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalizedName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1489,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Icon",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1490,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Security",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1491,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResource",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1492,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\StreamResourceType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1493,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\LocalRedirectOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1494,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Roamable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1495,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PreCreate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1496,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Stream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1497,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\PublishExpandedPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1498,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\DefinitionFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1499,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\Attributes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1500,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\FolderTypeID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,750",
        "eid": 1501,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\\InitFolderHandler",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1502,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Category",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1503,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Name",
          "content": "Personal"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1504,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParentFolder",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1505,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Description",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1506,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\RelativePath",
          "content": "Documents"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1507,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\ParsingName",
          "content": "shell:::{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\::{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1508,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InfoTip",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1509,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalizedName",
          "content": "@%SystemRoot%\\system32\\windows.storage.dll,-21770"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1510,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Icon",
          "content": "%SystemRoot%\\system32\\imageres.dll,-112"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1511,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Security",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1512,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResource",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1513,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\StreamResourceType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1514,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\LocalRedirectOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1515,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Roamable",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1516,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PreCreate",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1517,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Stream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1518,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\PublishExpandedPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1519,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\DefinitionFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1520,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\Attributes",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1521,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\FolderTypeID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1522,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FDD39AD0-238F-46AF-ADB4-6C85480369C7}\\InitFolderHandler",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1523,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\\Personal",
          "content": "%USERPROFILE%\\Documents"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1524,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Category",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1525,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Name",
          "content": "Fonts"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1526,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParentFolder",
          "content": "{F38BF404-1D43-42F2-9305-67DE0B28FC23}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1527,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Description",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1528,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\RelativePath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1529,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\ParsingName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1530,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InfoTip",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1531,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalizedName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1532,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Icon",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1533,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Security",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1534,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResource",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1535,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\StreamResourceType",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1536,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\LocalRedirectOnly",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1537,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Roamable",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1538,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PreCreate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1539,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Stream",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1540,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\PublishExpandedPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1541,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\DefinitionFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1542,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\Attributes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1543,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\FolderTypeID",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1544,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{FD228CB7-AE11-4AE3-864C-16F3910AB8FE}\\InitFolderHandler",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1545,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Drive\\shellex\\FolderExtensions\\{fbeb8a05-beee-4442-804e-409d6c4515e9}\\DriveMask",
          "content": "32"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1546,
        "data": {
          "file": "C:\\Windows\\System32\\windows.storage.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff94410000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1547,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1548,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1549,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\DllPath",
          "content": "C:\\Windows\\System32\\wpnapps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1550,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1551,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1552,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1553,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1554,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1555,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateInBrokerForMediumILContainer",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1556,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1557,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.Shell.TaskbarManager\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1558,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1559,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1560,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\DllPath",
          "content": "C:\\Windows\\System32\\windows.internal.shell.broker.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1561,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1562,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\TrustLevel",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1563,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1564,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1565,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1566,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1567,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,765",
        "eid": 1568,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.TaskbarPinnableSurface\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,781",
        "eid": 1569,
        "data": {
          "file": "gdi32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98480000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,781",
        "eid": 1570,
        "data": {
          "file": "C:\\Windows\\System32\\windows.internal.shell.broker.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7c210000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,781",
        "eid": 1571,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,781",
        "eid": 1572,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1573,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{7E470A8A-3ACD-5913-AF64-4AB78355BE5F}\\ProxyStubClsid32\\(Default)",
          "content": "{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1574,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1575,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1576,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1577,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1578,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1579,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1580,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1581,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1582,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1583,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1584,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1585,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1586,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1587,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1588,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{9F1FA092-87AA-C78A-4073-7E873ED1E3CF}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1589,
        "data": {
          "file": "C:\\Windows\\System32\\PCShellCommonProxyStub.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7d000000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1590,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1591,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1592,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1593,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1594,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\DllPath",
          "content": "C:\\Windows\\System32\\wpnapps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1595,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Threading",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1596,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1597,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1598,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1599,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1600,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateInBrokerForMediumILContainer",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1601,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1602,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.UI.StartScreen.StartScreenManager\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1603,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1604,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Server",
          "content": "UserManager"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1605,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1606,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1607,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1608,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1609,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1610,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1611,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1612,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1613,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\Permissions",
          "content": "\\x01\\x00\\x14\\x80\\x9c\\x00\\x00\\x00\\xa8\\x00\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00l\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x1f\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x008\\x00\\x1f\\x00\\x00\\x00\\x01\n\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x00\\x04\\x00\\x00\\xceJ\\x93Y\\xb9\\xcf\\x0buu\\xc0\\xf2\\x9b\\xb2\\xb4\\xc2\\x98\\xd4F\\xdd\\xf9\\x02z\\x87\\xec\\x14e\\x11w\\xd6\\xe9\\x96U\\x00\\x00\\x14\\x00\\x1f\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1614,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.System.User\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1615,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{155EB23B-242A-45E0-A2E9-3171FC6A7FDD}\\ProxyStubClsid32\\(Default)",
          "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1616,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{e44ea1df-bb85-5a8c-bddc-c8e960c355c9}\\ProxyStubClsid32\\(Default)",
          "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,796",
        "eid": 1617,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8cbd762a-1222-5ee5-b745-489e7a42c6ec}\\ProxyStubClsid32\\(Default)",
          "content": "{1BAC8681-2965-4FFC-92D1-170CA4099E01}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1618,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1619,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1620,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\DllPath",
          "content": "C:\\Windows\\System32\\TileDataRepository.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1621,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1622,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1623,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1624,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1625,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1626,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1627,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1628,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.Tiles.TileStore\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1629,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivationType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1630,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Server",
          "content": "StateRepository"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1631,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\DllPath",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1632,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Threading",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1633,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1634,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1635,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1636,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1637,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1638,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1639,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.StateRepository.TileView\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1640,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{6d3bc882-23a4-4706-b8fa-fc7de2fc325d}\\ProxyStubClsid32\\(Default)",
          "content": "{c53e07ec-25f3-4093-aa39-fc67ea22e99d}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1641,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart",
          "content": "Windows.Internal.ApplicationModel.StartPinnableSurface"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1642,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1643,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1644,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\DllPath",
          "content": "C:\\Windows\\System32\\StartTileData.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1645,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1646,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1647,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1648,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateAsUser",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1649,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1650,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1651,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,812",
        "eid": 1652,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Internal.ApplicationModel.StartPinnableSurface\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,828",
        "eid": 1653,
        "data": {
          "file": "C:\\Windows\\System32\\StartTileData.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff81f70000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,828",
        "eid": 1654,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,828",
        "eid": 1655,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:08,828",
        "eid": 1656,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,828",
        "eid": 1657,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,843",
        "eid": 1658,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PinnableSurfaces\\DefaultStart",
          "content": "Windows.Internal.ApplicationModel.StartPinnableSurface"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:08,843",
        "eid": 1659,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\SecurityManager\\AdminCapabilities\\shellExperience",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,843",
        "eid": 1660,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,843",
        "eid": 1661,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,843",
        "eid": 1662,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,843",
        "eid": 1663,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:08,859",
        "eid": 1664,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:13,843",
        "eid": 1665,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:13,859",
        "eid": 1666,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:13,859",
        "eid": 1667,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:18,875",
        "eid": 1668,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:18,875",
        "eid": 1669,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:18,875",
        "eid": 1670,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:18,875",
        "eid": 1671,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:18,875",
        "eid": 1672,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:18,875",
        "eid": 1673,
        "data": {
          "file": "\\Device\\NamedPipe\\LOCAL\\mojo.7284.11744.16520997012828528981"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,094",
        "eid": 1674,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1675,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1676,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1677,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1678,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1679,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1680,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\COM3\\Com+Enabled",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1681,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1682,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": "Delivery Optimization User"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1683,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalService",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1684,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1685,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate",
          "content": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1686,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RunAs",
          "content": "Interactive User"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1687,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateAtStorage",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1688,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ROTFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1689,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppIDFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1690,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\MGOTFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1691,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProcessMitigationPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1692,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1693,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission",
          "content": "\\x01\\x00\\x04\\x80`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00L\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1694,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1695,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1696,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1697,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RemoteServerName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1698,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\SRPTrustLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1699,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\PreferredServerBitness",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1700,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LoadUserSettings",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1701,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProtectionLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1702,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1703,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1704,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1705,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1706,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1707,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1708,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AccessPermission",
          "content": "\\x01\\x00\\x04\\x80\\\\x00\\x00\\x00l\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00H\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1709,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1710,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1711,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\\NdrOleExtDLL",
          "content": "combase.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1712,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,110",
        "eid": 1713,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,126",
        "eid": 1714,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,126",
        "eid": 1715,
        "data": {
          "file": "C:\\Windows\\System32\\uxtheme.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff93cf0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,126",
        "eid": 1716,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,126",
        "eid": 1717,
        "data": {
          "regkey": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\\AppsUseLightTheme",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1718,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1719,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1720,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": "Delivery Optimization User Class"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1721,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1722,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1723,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)",
          "content": "%SystemRoot%\\system32\\domgmt.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1724,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1725,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1726,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1727,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1728,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": "Delivery Optimization User Class"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1729,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1730,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1731,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\(Default)",
          "content": "%SystemRoot%\\system32\\domgmt.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1732,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1733,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppID",
          "content": "{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1734,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1735,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\(Default)",
          "content": "Delivery Optimization User"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1736,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LocalService",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1737,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1738,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\DllSurrogate",
          "content": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1739,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RunAs",
          "content": "Interactive User"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1740,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ActivateAtStorage",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1741,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ROTFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1742,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AppIDFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1743,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\MGOTFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1744,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProcessMitigationPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1745,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1746,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LaunchPermission",
          "content": "\\x01\\x00\\x04\\x80`\\x00\\x00\\x00p\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00L\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1747,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1748,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\LegacyImpersonationLevel",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1749,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\AuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1750,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\RemoteServerName",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1751,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\SRPTrustLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1752,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\PreferredServerBitness",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1753,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\LoadUserSettings",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,141",
        "eid": 1754,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\\ProtectionLevel",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1755,
        "data": {
          "file": "C:\\Windows\\System32\\domgmt.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff3a0b0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1756,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1757,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1758,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{8863F93E-77EA-4C67-A86F-7638E3A568A6}\\ProxyStubClsid32\\(Default)",
          "content": "{A6FF50C0-56C0-71CA-5732-BED303A59628}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1759,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1760,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1761,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1762,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1763,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1764,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1765,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1766,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1767,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1768,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\(Default)",
          "content": "PSFactoryBuffer"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1769,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1770,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1771,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1772,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1773,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{A6FF50C0-56C0-71CA-5732-BED303A59628}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1774,
        "data": {
          "file": "C:\\Windows\\System32\\OneCoreCommonProxyStub.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff874d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,157",
        "eid": 1775,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,172",
        "eid": 1776,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,172",
        "eid": 1777,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,172",
        "eid": 1778,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,172",
        "eid": 1779,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,172",
        "eid": 1780,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,172",
        "eid": 1781,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,172",
        "eid": 1782,
        "data": {
          "file": "oleaut32.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,809",
        "eid": 1783,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,809",
        "eid": 1784,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,809",
        "eid": 1785,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,809",
        "eid": 1786,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,809",
        "eid": 1787,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,809",
        "eid": 1788,
        "data": {
          "file": "api-ms-win-core-fibers-l1-1-1",
          "pathtofile": null,
          "moduleaddress": "0x7fff964d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,809",
        "eid": 1789,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1790,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1791,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1792,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1793,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1794,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1795,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled",
          "content": null
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1796,
        "data": {
          "file": "C:\\ProgramData"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1797,
        "data": {
          "file": "C:\\ProgramData\\USOShared"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1798,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,825",
        "eid": 1799,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1800,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\~MHz",
          "content": "3686"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1801,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\Bias",
          "content": "300"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1802,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardName",
          "content": "Eastern Standard Time"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1803,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardBias",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1804,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardStart",
          "content": "\\x00\\x00\\x0b\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1805,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightName",
          "content": "Eastern Daylight Time"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1806,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightBias",
          "content": "18446744073709551556"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1807,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightStart",
          "content": "\\x00\\x00\\x03\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1808,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1809,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerCorrelationId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,840",
        "eid": 1810,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerType",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,856",
        "eid": 1811,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,856",
        "eid": 1812,
        "data": {
          "file": "C:\\ProgramData"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,856",
        "eid": 1813,
        "data": {
          "file": "C:\\ProgramData\\USOShared"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,856",
        "eid": 1814,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,856",
        "eid": 1815,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,856",
        "eid": 1816,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\~MHz",
          "content": "3686"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1817,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\Bias",
          "content": "300"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1818,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardName",
          "content": "Eastern Standard Time"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1819,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardBias",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1820,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\StandardStart",
          "content": "\\x00\\x00\\x0b\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1821,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightName",
          "content": "Eastern Daylight Time"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1822,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightBias",
          "content": "18446744073709551556"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1823,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\TimeZoneInformation\\DaylightStart",
          "content": "\\x00\\x00\\x03\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1824,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1825,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerCorrelationId",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1826,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\ContainerType",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,872",
        "eid": 1827,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\WuProvider.a11b7b39-47d3-4445-ba94-a9ffc89781cb.1.etl"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1828,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1829,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1830,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1831,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\(Default)",
          "content": "MoUsoCoreWorker COM class"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1832,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\Appx\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1833,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\AppModelUnlock\\AllowDevelopmentWithoutDevLicense",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1834,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1835,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseActivationAuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1836,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\mousocoreworker.exe\\AppID",
          "content": "{D726464B-98F1-4627-86CD-4A082A1E5307}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1837,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AuthenticationLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1838,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\AppCompat\\RaiseDefaultAuthnLevel",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1839,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{D726464B-98F1-4627-86CD-4A082A1E5307}\\AccessPermission",
          "content": "\\x01\\x00\\x04\\x80\\xb0\\x00\\x00\\x00\\xc0\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x00\\x00\\x02\\x00\\x9c\\x00\\x06\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x03\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x00\\x00\\x18\\x00\\x03\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00!\\x02\\x00\\x00\\x00\\x00(\\x00\\x03\\x00\\x00\\x00\\x01\\x06\\x00\\x00\\x00\\x00\\x00\\x05P\\x00\\x00\\x00\\xf9\\x08W\rm\\xed\\xefd\\x82E\\x1a\\x07\\x80\t\\xddu\\xad\\x99\\xa0S\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x05 \\x00\\x00\\x00 \\x02\\x00\\x00"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1840,
        "data": {
          "file": "C:\\Windows\\system32\\rpcss.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1841,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{00000134-0000-0000-C000-000000000046}\\ProxyStubClsid32\\(Default)",
          "content": "{00000320-0000-0000-C000-000000000046}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,887",
        "eid": 1842,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1843,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole\\MaxSxSHashCount",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1844,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{B2168CAC-969E-43DD-A3AB-A4DD612E223D}\\ProxyStubClsid32\\(Default)",
          "content": "{607C052E-2B08-4548-BD1D-EB7665A34788}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1845,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1846,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1847,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)",
          "content": "Uso Core Service Proxy Stub"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1848,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1849,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1850,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\usocoreps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1851,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1852,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1853,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1854,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\(Default)",
          "content": "Uso Core Service Proxy Stub"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1855,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1856,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1857,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\usocoreps.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1858,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1859,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{607C052E-2B08-4548-BD1D-EB7665A34788}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1860,
        "data": {
          "file": "C:\\Windows\\System32\\usocoreps.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff7de30000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1861,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1862,
        "data": {
          "file": "combase.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1863,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1864,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1865,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1866,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\AllowedUpdateManagerCtorFailures",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1867,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
          "content": "1"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,903",
        "eid": 1868,
        "data": {
          "file": "C:\\ProgramData"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1869,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1870,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1871,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1872,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1873,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1874,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1875,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1876,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1877,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1878,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1879,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1880,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1881,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1882,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1883,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1884,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,918",
        "eid": 1885,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,934",
        "eid": 1886,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,934",
        "eid": 1887,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,950",
        "eid": 1888,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,950",
        "eid": 1889,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,950",
        "eid": 1890,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,965",
        "eid": 1891,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,965",
        "eid": 1892,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,981",
        "eid": 1893,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,997",
        "eid": 1894,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:53,997",
        "eid": 1895,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,012",
        "eid": 1896,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,028",
        "eid": 1897,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1898,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1899,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1900,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1901,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1902,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1903,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1904,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1905,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1906,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1907,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEnginePatch",
          "content": "{\"tables\":[{\"name\":\"System Wake Allowed\",\"rules\":[{\"checks\":[[\"Policy active hours restricted\",\"=\",true]],\"result\":true},{\"checks\":[[\"Policy Scheduled Install\",\"=\",true]],\"result\":true},{\"checks\":[],\"result\":false}]},{\"name\":\"System Enable Prehibernate Wak"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,122",
        "eid": 1908,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\DecisionEngine",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,137",
        "eid": 1909,
        "data": {
          "file": "api-ms-win-core-synch-l1-2-0.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1910,
        "data": {
          "file": "C:\\Windows\\System32\\wuapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff80ca0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1911,
        "data": {
          "file": "wups.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff93940000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1912,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98c50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1913,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1914,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\isV2Provider",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1915,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\officeclicktorun\\isV2Provider",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1916,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\uso\\isV2Provider",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1917,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1918,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,153",
        "eid": 1919,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1920,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1921,
        "data": {
          "regkey": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\sCurrency",
          "content": "$"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1922,
        "data": {
          "regkey": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\iCalendarType",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1923,
        "data": {
          "regkey": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Currencies",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1924,
        "data": {
          "regkey": "HKEY_USERS\\.DEFAULT\\Control Panel\\International\\\\xed\\xa0\\xbc\\xed\\xbc\\x8e\\xed\\xa0\\xbc\\xed\\xbc\\x8f\\xed\\xa0\\xbc\\xed\\xbc\\x8d\\Calendar",
          "content": "Gregorian"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1925,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1926,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1927,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Versions\\000603xx",
          "content": "kernel32.dll"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1928,
        "data": {
          "file": "kernel32.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff98b50000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1929,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1930,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-AU",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,231",
        "eid": 1931,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:54,262",
        "eid": 1932,
        "data": {
          "file": "C:\\Windows\\System32\\wups.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff93940000"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,262",
        "eid": 1933,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,262",
        "eid": 1934,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1935,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings\\RootDirectory",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1936,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\EditionSettings\\RootDirectory",
          "content": "%WINDIR%"
        }
      },
      {
        "event": "create",
        "object": "dir",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1937,
        "data": {
          "file": "C:\\Windows\\SoftwareDistribution"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1938,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1939,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1940,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1941,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1942,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1943,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,293",
        "eid": 1944,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,325",
        "eid": 1945,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,340",
        "eid": 1946,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,340",
        "eid": 1947,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,340",
        "eid": 1948,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,340",
        "eid": 1949,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,340",
        "eid": 1950,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,356",
        "eid": 1951,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,356",
        "eid": 1952,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,372",
        "eid": 1953,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,372",
        "eid": 1954,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,372",
        "eid": 1955,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,372",
        "eid": 1956,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,403",
        "eid": 1957,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,403",
        "eid": 1958,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:54,403",
        "eid": 1959,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:54,403",
        "eid": 1960,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:55,981",
        "eid": 1961,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:55,981",
        "eid": 1962,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:55,981",
        "eid": 1963,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,465",
        "eid": 1964,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,465",
        "eid": 1965,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,465",
        "eid": 1966,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,465",
        "eid": 1967,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\isV2Provider",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,465",
        "eid": 1968,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,465",
        "eid": 1969,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,465",
        "eid": 1970,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\queuedTime",
          "content": "\\xcc\\x9a\\xf59\\x00\\xef\\xdc\\x01"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1971,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\cmdLine",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1972,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\cmdLine",
          "content": "C:\\Windows\\System32\\usoclient.exe"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1973,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1974,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1975,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\startArg",
          "content": "StartStoreUpdates"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1976,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1977,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1978,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\pauseArg",
          "content": "PauseStoreUpdates"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1979,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1980,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1981,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\workCompleted",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1982,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1983,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1984,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterOOBEDurationInMinutes",
          "content": "7200"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1985,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1986,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1987,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterPriority",
          "content": "9"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1988,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1989,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1990,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterBehindSlaInDays",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1991,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\updaterDisabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1992,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UScheduler\\ia\\scanFrequency",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1993,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SetupSupported",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1994,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\WinInit\\Headless",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1995,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1996,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\UpdateManagerCtorFailures",
          "content": "0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1997,
        "data": {
          "file": "api-ms-win-appmodel-runtime-l1-1-2",
          "pathtofile": null,
          "moduleaddress": "0x7fff94210000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,481",
        "eid": 1998,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 1999,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2000,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2001,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2002,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2003,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2004,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2005,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2006,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2007,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2008,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2009,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2010,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2011,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2012,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\DetectionFrequency",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2013,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2014,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{A37467DB-1DE5-4A3E-B9E1-D010EBA71143}\\ProxyStubClsid32\\(Default)",
          "content": "{11F11442-3359-410C-875E-D21984507B62}"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,497",
        "eid": 2015,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2016,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2017,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2018,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)",
          "content": "Orchestrator Core Service Proxy Stub"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2019,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2020,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2021,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\usoapi.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2022,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2023,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\DetectionFrequency\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2024,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2025,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2026,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\(Default)",
          "content": "Orchestrator Core Service Proxy Stub"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2027,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\InprocServer32",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2028,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2029,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\(Default)",
          "content": "C:\\Windows\\System32\\usoapi.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2030,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\InProcServer32\\ThreadingModel",
          "content": "Both"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2031,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\CLSID\\{11F11442-3359-410C-875E-D21984507B62}\\AppID",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2032,
        "data": {
          "file": "C:\\Windows\\System32\\usoapi.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff3a110000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2033,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2034,
        "data": {
          "file": "C:\\Windows\\System32\\FlightSettings.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff80eb0000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2035,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\PilotInfoRing",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2036,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\ClientState\\ErrorState",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2037,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2038,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2039,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2040,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\DllPath",
          "content": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2041,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2042,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2043,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2044,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2045,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2046,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2047,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2048,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformation\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2049,
        "data": {
          "file": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff82b00000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2050,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2051,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2052,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2053,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\DllPath",
          "content": "C:\\Windows\\System32\\Windows.Networking.Connectivity.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2054,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2055,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\TrustLevel",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2056,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2057,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2058,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2059,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2060,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2061,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\Permissions",
          "content": "\\x01\\x00\\x14\\x804\\x01\\x00\\x00@\\x01\\x00\\x00\\x14\\x00\\x00\\x000\\x00\\x00\\x00\\x02\\x00\\x1c\\x00\\x01\\x00\\x00\\x00\\x11\\x00\\x14\\x00\\x04\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x10\\x00\\x10\\x00\\x00\\x02\\x00\\x04\\x01\t\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x02\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x01\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x18\\x00\\x0b\\x00\\x00\\x00\\x01\\x02\\x00\\x00\\x00\\x00\\x00\\x0f\\x03\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\n\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x13\\x00\\x00\\x00\\x00\\x00\\x14\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x14\\x00\\x00\\x00\t\\x00L\\x00\\x0b\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x04\\x00\\x00\\x00artx\\xf8.\\x00\\x00\\x00W\\x00I\\x00N\\x00:\\x00/\\x00/\\x00I\\x00S\\x00M\\x00U\\x00L\\x00T\\x00I\\x00S\\x00E\\x00S\\x00S\\x00I\\x00O\\x00N\\x00S\\x00K\\x00U\\x00\\xa2\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x05\\x12\\x00\\x00\\x00"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2062,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Networking.Connectivity.NetworkInformationPrivate\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2063,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\Setup\\SystemSetupInProgress",
          "content": "0"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2064,
        "data": {
          "file": "C:\\Windows\\System32\\npmproxy.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff8e350000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2065,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{5DF486F8-50EB-427E-8DA3-7122CCAF9415}\\ProxyStubClsid32\\(Default)",
          "content": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2066,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{9844E0CA-F034-40A2-AADA-84671C0E21AB}\\ProxyStubClsid32\\(Default)",
          "content": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2067,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{DE2F3CF5-D9CD-4284-ADA8-1EDB8A23FFA9}\\ProxyStubClsid32\\(Default)",
          "content": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2068,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{84D31176-4A5A-4419-B07F-809FBA936A0A}\\ProxyStubClsid32\\(Default)",
          "content": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2069,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{2A1C9EB2-DF62-4154-B800-63278FCB8037}\\ProxyStubClsid32\\(Default)",
          "content": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2070,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{85D85DDF-7DA6-499E-BA87-B58AF906435F}\\ProxyStubClsid32\\(Default)",
          "content": "{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2071,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivationType",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2072,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Server",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2073,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\DllPath",
          "content": "C:\\Windows\\System32\\WinTypes.dll"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2074,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Threading",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2075,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\TrustLevel",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2076,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\RemoteServer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2077,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateAsUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2078,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInSharedBroker",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2079,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateInBrokerForMediumILContainer",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2080,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\Permissions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,512",
        "eid": 2081,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsRuntime\\ActivatableClassId\\Windows.Foundation.PropertyValue\\ActivateOnHostFlags",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2082,
        "data": {
          "file": "C:\\Windows\\System32\\WinTypes.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff92180000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2083,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2084,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\Applicability\\IsBuildFlightingEnabled",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2085,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsSelfHost\\OneSettings\\IsBuildUnsupported",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2086,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\PolicyType",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2087,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2088,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\MergeAlgorithm",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2089,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2090,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2091,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2092,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2093,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2094,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2095,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2096,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ManagePreviewBuilds\\Value",
          "content": "3"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2097,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\PolicyType",
          "content": "4"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2098,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2099,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\MergeAlgorithm",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2100,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirectMapped",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2101,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\RegKeyPathRedirect",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2102,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\grouppolicyname",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2103,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataUser",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2104,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataDevice",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2105,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\ADMXMetadataBoth",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2106,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\30Value",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2107,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\System\\AllowBuildPreview\\Value",
          "content": "2"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2108,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2109,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2110,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2111,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2112,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2113,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2114,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2115,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2116,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2117,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2118,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2119,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2120,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2121,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2122,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2123,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2124,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2125,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2126,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2127,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2128,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2129,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2130,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2131,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2132,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2133,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2134,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2135,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2136,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2137,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2138,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2139,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2140,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2141,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2142,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2143,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2144,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2145,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2146,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2147,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2148,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2149,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2150,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2151,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2152,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2153,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2154,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2155,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2156,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2157,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2158,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2159,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2160,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2161,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2162,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2163,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2164,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en-US",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2165,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\Sorting\\Ids\\en",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2166,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2167,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2168,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2169,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2170,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2171,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2172,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2173,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2174,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2175,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2176,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2177,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2178,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2179,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2180,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2181,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2182,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2183,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2184,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2185,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2186,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,528",
        "eid": 2187,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2188,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2189,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2190,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2191,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2192,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2193,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2194,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2195,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2196,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2197,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2198,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2199,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2200,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2201,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2202,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2203,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2204,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2205,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2206,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2207,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2208,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2209,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2210,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2211,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2212,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2213,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2214,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2215,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2216,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2217,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2218,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2219,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2220,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2221,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2222,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2223,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2224,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2225,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2226,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2227,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2228,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2229,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2230,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2231,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2232,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2233,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2234,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2235,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2236,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2237,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2238,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2239,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2240,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2241,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2242,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2243,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,543",
        "eid": 2244,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2245,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2246,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2247,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2248,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2249,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2250,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2251,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2252,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2253,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2254,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2255,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2256,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2257,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2258,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2259,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2260,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2261,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2262,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2263,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2264,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2265,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2266,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2267,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2268,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2269,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2270,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2271,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2272,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2273,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2274,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2275,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2276,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2277,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2278,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2279,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2280,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2281,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2282,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2283,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2284,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2285,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2286,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2287,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2288,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2289,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2290,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2291,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2292,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2293,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2294,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2295,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2296,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2297,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2298,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2299,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2300,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2301,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2302,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2303,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2304,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2305,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2306,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2307,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2308,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2309,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2310,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2311,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2312,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2313,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2314,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2315,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2316,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2317,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2318,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2319,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,559",
        "eid": 2320,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2321,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2322,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2323,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2324,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2325,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2326,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2327,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2328,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2329,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2330,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2331,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2332,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2333,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2334,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2335,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2336,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2337,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2338,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2339,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2340,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2341,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2342,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2343,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2344,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2345,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AUPowerManagement",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2346,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2347,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerEndHour",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2348,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2349,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2350,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2351,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2352,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2353,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursEnd",
          "content": "17"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2354,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerStartHour",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2355,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2356,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2357,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2358,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2359,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2360,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\UX\\Settings\\ActiveHoursStart",
          "content": "8"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2361,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDelayInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2362,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDurationInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2363,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\SmartSchedulerDelayInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2364,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\FirstEntry",
          "content": "2006"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2365,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\LastEntry",
          "content": "2007"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2366,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2026",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2367,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Time Zones\\Eastern Standard Time\\Dynamic DST\\2007",
          "content": ",\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\xc4\\xff\\xff\\xff\\x00\\x00\\x0b\\x00\\x00\\x00\\x01\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x03\\x00\\x00\\x00\\x02\\x00\\x02\\x00\\x00\\x00\\x00\\x00\\x00\\x00"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2368,
        "data": {
          "file": "api-ms-win-security-systemfunctions-l1-1-0",
          "pathtofile": null,
          "moduleaddress": "0x7fff983c0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,575",
        "eid": 2369,
        "data": {
          "file": null,
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2370,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2371,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2372,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2373,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2374,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2375,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2376,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2377,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2378,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2379,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2380,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2381,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2382,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2383,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2384,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2385,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2386,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2387,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2388,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2389,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2390,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2391,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2392,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2393,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2394,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2395,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2396,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2397,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2398,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2399,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2400,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2401,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2402,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2403,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2404,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2405,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2406,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2407,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2408,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2409,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2410,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2411,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2412,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2413,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2414,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2415,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2416,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2417,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2418,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2419,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2420,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2421,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,590",
        "eid": 2422,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2423,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2424,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2425,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2426,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2427,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2428,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2429,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2430,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2431,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2432,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2433,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2434,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2435,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2436,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2437,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2438,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2439,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2440,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2441,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2442,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2443,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2444,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2445,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2446,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2447,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2448,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2449,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2450,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2451,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2452,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2453,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2454,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2455,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2456,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2457,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2458,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2459,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2460,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2461,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2462,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2463,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2464,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2465,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2466,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2467,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2468,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2469,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2470,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2471,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2472,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2473,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2474,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2475,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2476,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2477,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2478,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2479,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2480,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2481,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2482,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2483,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2484,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2485,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2486,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2487,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2488,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2489,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2490,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2491,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,606",
        "eid": 2492,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2493,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2494,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2495,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2496,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2497,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2498,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2499,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2500,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2501,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2502,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2503,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2504,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2505,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2506,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2507,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2508,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2509,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2510,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2511,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2512,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2513,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2514,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2515,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2516,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2517,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2518,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2519,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2520,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2521,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2522,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2523,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2524,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2525,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2526,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2527,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2528,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2529,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2530,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2531,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2532,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2533,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2534,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2535,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2536,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2537,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2538,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2539,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2540,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2541,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2542,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2543,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2544,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2545,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2546,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2547,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2548,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2549,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2550,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2551,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2552,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,622",
        "eid": 2553,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2554,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2555,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2556,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2557,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2558,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2559,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2560,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2561,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2562,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2563,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2564,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2565,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2566,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2567,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2568,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2569,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2570,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2571,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2572,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2573,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2574,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2575,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2576,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2577,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2578,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2579,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2580,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2581,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2582,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2583,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2584,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2585,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2586,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2587,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2588,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2589,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2590,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2591,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2592,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2593,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2594,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2595,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2596,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2597,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2598,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2599,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2600,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2601,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2602,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2603,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2604,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2605,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2606,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2607,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2608,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2609,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2610,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2611,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2612,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2613,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2614,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2615,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2616,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2617,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,637",
        "eid": 2618,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2619,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2620,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2621,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2622,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2623,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2624,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2625,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2626,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2627,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2628,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2629,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2630,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2631,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2632,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2633,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2634,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2635,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2636,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2637,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2638,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2639,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2640,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2641,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2642,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2643,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2644,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2645,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2646,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2647,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2648,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2649,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2650,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2651,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2652,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2653,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2654,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2655,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2656,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2657,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2658,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2659,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2660,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2661,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2662,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2663,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2664,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2665,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2666,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2667,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2668,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2669,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2670,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2671,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2672,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2673,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2674,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2675,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2676,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2677,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2678,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2679,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2680,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2681,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2682,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2683,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2684,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2685,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2686,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2687,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2688,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2689,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2690,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2691,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2692,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2693,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2694,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2695,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2696,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2697,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2698,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2699,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2700,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2701,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2702,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2703,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2704,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2705,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2706,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2707,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2708,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2709,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2710,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2711,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2712,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2713,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2714,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2715,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2716,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2717,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2718,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2719,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2720,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,653",
        "eid": 2721,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2722,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2723,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2724,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2725,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2726,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2727,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2728,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2729,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2730,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2731,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2732,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2733,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2734,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2735,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2736,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2737,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2738,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2739,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2740,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2741,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2742,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2743,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2744,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2745,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2746,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2747,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2748,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2749,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2750,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2751,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2752,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2753,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2754,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2755,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2756,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,668",
        "eid": 2757,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2758,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2759,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2760,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2761,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2762,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2763,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2764,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2765,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2766,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2767,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2768,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2769,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2770,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2771,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2772,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2773,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2774,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2775,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2776,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2777,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2778,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2779,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2780,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2781,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2782,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2783,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2784,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2785,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2786,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2787,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2788,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2789,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2790,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2791,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2792,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2793,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2794,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2795,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2796,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2797,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2798,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2799,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2800,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2801,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2802,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2803,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2804,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2805,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2806,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2807,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2808,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2809,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2810,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2811,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2812,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2813,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2814,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2815,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2816,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2817,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2818,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2819,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2820,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2821,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2822,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2823,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2824,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2825,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2826,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2827,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2828,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2829,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2830,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2831,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2832,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2833,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2834,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2835,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2836,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2837,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2838,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2839,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2840,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2841,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2842,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,684",
        "eid": 2843,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2844,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2845,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2846,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2847,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2848,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2849,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2850,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2851,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2852,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2853,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2854,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2855,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2856,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2857,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2858,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2859,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2860,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2861,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2862,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2863,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2864,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2865,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2866,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2867,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2868,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2869,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2870,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2871,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,700",
        "eid": 2872,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2873,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2874,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2875,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2876,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2877,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2878,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2879,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2880,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2881,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2882,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2883,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2884,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2885,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2886,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2887,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2888,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2889,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2890,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2891,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2892,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2893,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2894,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2895,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2896,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2897,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2898,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2899,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2900,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2901,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2902,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2903,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2904,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2905,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2906,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2907,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2908,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,715",
        "eid": 2909,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2910,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2911,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2912,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2913,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2914,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2915,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2916,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2917,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2918,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2919,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2920,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2921,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2922,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2923,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2924,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2925,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2926,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2927,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2928,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2929,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2930,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2931,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2932,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2933,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2934,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2935,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2936,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2937,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2938,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2939,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2940,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2941,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2942,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2943,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2944,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2945,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2946,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2947,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2948,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2949,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2950,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2951,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2952,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2953,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2954,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2955,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2956,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2957,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2958,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2959,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2960,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,731",
        "eid": 2961,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2962,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2963,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2964,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2965,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2966,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2967,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2968,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2969,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2970,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2971,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2972,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2973,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2974,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2975,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2976,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2977,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2978,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2979,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2980,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2981,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2982,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2983,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2984,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2985,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2986,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2987,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2988,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2989,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2990,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,747",
        "eid": 2991,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2992,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2993,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2994,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2995,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2996,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2997,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2998,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 2999,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3000,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3001,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3002,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3003,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3004,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3005,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3006,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3007,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3008,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3009,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3010,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3011,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3012,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3013,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3014,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3015,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3016,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3017,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3018,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3019,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3020,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3021,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3022,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3023,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3024,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3025,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3026,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3027,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3028,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3029,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3030,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3031,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3032,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3033,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3034,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3035,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3036,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3037,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3038,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3039,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3040,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3041,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3042,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3043,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3044,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3045,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3046,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3047,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3048,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3049,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3050,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3051,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3052,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3053,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3054,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3055,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3056,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3057,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3058,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3059,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3060,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3061,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3062,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3063,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3064,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3065,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3066,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3067,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3068,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3069,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3070,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3071,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3072,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3073,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3074,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3075,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3076,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3077,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3078,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3079,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3080,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,762",
        "eid": 3081,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3082,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3083,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3084,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3085,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3086,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3087,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3088,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3089,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3090,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3091,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3092,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3093,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3094,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3095,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3096,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3097,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3098,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3099,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3100,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3101,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3102,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3103,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3104,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3105,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3106,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3107,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3108,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3109,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3110,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3111,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3112,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3113,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3114,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3115,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3116,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3117,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3118,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3119,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3120,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3121,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3122,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3123,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3124,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3125,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3126,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3127,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3128,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3129,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3130,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3131,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3132,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3133,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3134,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3135,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3136,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3137,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3138,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3139,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3140,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3141,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3142,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3143,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3144,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3145,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,778",
        "eid": 3146,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3147,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3148,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3149,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3150,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3151,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3152,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3153,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3154,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3155,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3156,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3157,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3158,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3159,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3160,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3161,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3162,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3163,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3164,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3165,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3166,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3167,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3168,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3169,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3170,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3171,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3172,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3173,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3174,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3175,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3176,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3177,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3178,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3179,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3180,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3181,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3182,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3183,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3184,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3185,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3186,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3187,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3188,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3189,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3190,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3191,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3192,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3193,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3194,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3195,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3196,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3197,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3198,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3199,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3200,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3201,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3202,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3203,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3204,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3205,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3206,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3207,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3208,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3209,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3210,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3211,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3212,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,793",
        "eid": 3213,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3214,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3215,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3216,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3217,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3218,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3219,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3220,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3221,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3222,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3223,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3224,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3225,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3226,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3227,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3228,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3229,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3230,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3231,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3232,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3233,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3234,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3235,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3236,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3237,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3238,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3239,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3240,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3241,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3242,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3243,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3244,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3245,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3246,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3247,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3248,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3249,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3250,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3251,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3252,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3253,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3254,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3255,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3256,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3257,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3258,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3259,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3260,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3261,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3262,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3263,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3264,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3265,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3266,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3267,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3268,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3269,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3270,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3271,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3272,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3273,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3274,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3275,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3276,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,809",
        "eid": 3277,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3278,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3279,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3280,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3281,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3282,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3283,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3284,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3285,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3286,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3287,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3288,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3289,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3290,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3291,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3292,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3293,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3294,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3295,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3296,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3297,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3298,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3299,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3300,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3301,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3302,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3303,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3304,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3305,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3306,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3307,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3308,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3309,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3310,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3311,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3312,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3313,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3314,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3315,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3316,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3317,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3318,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3319,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3320,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,825",
        "eid": 3321,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3322,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3323,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3324,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3325,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3326,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3327,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3328,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3329,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3330,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3331,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3332,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3333,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3334,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3335,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3336,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3337,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3338,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3339,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3340,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3341,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3342,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3343,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3344,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3345,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3346,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3347,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3348,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3349,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3350,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3351,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3352,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3353,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3354,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3355,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.Edge.Stable.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3356,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3357,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Microsoft.NETFX.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3358,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3359,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Appraiser.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3360,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3361,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.AppraiserData.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3362,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3363,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3364,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.Autopilot.amd64\\HiddenFromEnumeration",
          "content": "1"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3365,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3366,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.EmergencyUpdate.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3367,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3368,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.FeatureExperiencePack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3369,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3370,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.OOBE.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3371,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3372,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Windows.UpdateStackPackage.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3373,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3374,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\Hammer.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3375,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3376,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\MSRT.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3377,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3378,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\SedimentPack.amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3379,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3380,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{0005a67e-b5cb-59d5-b9fd-be410637d24e}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3381,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3382,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{3caa035f-84c2-5a5b-ae1b-7871c1aa1b19}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3383,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3384,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{7e1dcd2d-e5e6-561b-b17d-4f52d723ae26}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3385,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3386,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{809e9742-9baf-5679-9081-0c1c2e0935be}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3387,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3388,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{817fca52-ae83-52f5-8642-9497f79d49d0}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3389,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,840",
        "eid": 3390,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{8872d048-2b5e-5ccb-a3d5-d8b458a2e76c}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3391,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3392,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{afeadca3-91fd-5153-b3e2-e0530ba078a6}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3393,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3394,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c74cd837-863e-5cdb-b574-a5a47eb3ec16}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3395,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3396,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{c8727a1c-b70d-5e63-9fdc-a18a1abcd298}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3397,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3398,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{cf753946-e8a9-5935-b736-66669dd194b3}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3399,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3400,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{d1ab7fd2-210a-5ed8-8509-8650e5d68fc8}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3401,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\Version",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3402,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\DynamicInstalled\\{ee917961-5250-5822-bca9-65ef9962de49}_amd64\\HiddenFromEnumeration",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3403,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3404,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Update\\TargetingInfo\\Installed\\Client.OS.rs2.amd64\\PrimaryOSProduct",
          "content": "1"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3405,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3406,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\RequireUpdateApproval\\Behavior",
          "content": "32"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3407,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3408,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3409,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3410,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3411,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3412,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3413,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3414,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3415,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3416,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3417,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3418,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3419,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3420,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3421,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3422,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3423,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3424,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3425,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3426,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3427,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3428,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3429,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3430,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3431,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3432,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3433,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3434,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3435,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3436,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3437,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\ComplianceDeadlineExpeditedThreshold",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3438,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3439,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ConfigureDeadlineForQualityUpdates\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3440,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ConfigureDeadlineForQualityUpdates",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3441,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3442,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3443,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3444,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3445,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3446,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3447,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3448,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3449,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,856",
        "eid": 3450,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3451,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3452,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3453,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3454,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3455,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3456,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3457,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3458,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3459,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3460,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3461,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3462,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3463,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3464,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3465,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3466,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3467,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3468,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3469,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3470,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3471,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3472,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3473,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3474,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3475,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3476,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
          "content": ""
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3477,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3478,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3479,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3480,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3481,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\DeviceAccess\\ActivePolicyCode",
          "content": ""
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3482,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3483,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3484,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3485,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3486,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3487,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3488,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3489,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3490,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3491,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\AllowAutoUpdate\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3492,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\AllowAutoUpdate",
          "content": null
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:32:58,872",
        "eid": 3493,
        "data": {
          "file": "C:\\ProgramData\\USOShared\\Logs\\System\\MoUsoCoreWorker.1d10bfa3-38d6-4069-868b-5e8d9bed4ded.1.etl"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3494,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\OOBE\\OOBECompleteTimestamp\\OOBECompleteTimestamp",
          "content": "\\xea\\x07\\x05\\x00\\x04\\x00\\x1c\\x00\\x0f\\x00\\x1d\\x00;\\x00\\x8d\\x03"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3495,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3496,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3497,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions",
          "content": "0"
        }
      },
      {
        "event": "delete",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3498,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\EnhancedShutdownEnabled"
        }
      },
      {
        "event": "write",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3499,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\WindowsUpdate\\Orchestrator\\ShutdownFlyoutOptions",
          "content": "0"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3500,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\UsePowerButtonIcon",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3501,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3502,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3503,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3504,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3505,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3506,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3507,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3508,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3509,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3510,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3511,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3512,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3513,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3514,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3515,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3516,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3517,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3518,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3519,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3520,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3521,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3522,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3523,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3524,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3525,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3526,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3527,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3528,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3529,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3530,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3531,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3532,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3533,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3534,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3535,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3536,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3537,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3538,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3539,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3540,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3541,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3542,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3543,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3544,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3545,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3546,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3547,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3548,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,887",
        "eid": 3549,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3550,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3551,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3552,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3553,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3554,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3555,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3556,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3557,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3558,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3559,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3560,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3561,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3562,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\SetEDURestart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3563,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\SetEDURestart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3564,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3565,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursStart\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3566,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursStart",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3567,
        "data": {
          "file": "ntdll.dll",
          "pathtofile": null,
          "moduleaddress": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3568,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\default\\Update\\ActiveHoursEnd\\Behavior",
          "content": "73760"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:32:58,903",
        "eid": 3569,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Lus\\ActiveHoursEnd",
          "content": null
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:33:01,059",
        "eid": 3570,
        "data": {
          "file": "C:\\Windows\\System32\\taskschd.dll",
          "pathtofile": null,
          "moduleaddress": "0x7fff913d0000"
        }
      },
      {
        "event": "load",
        "object": "library",
        "timestamp": "2026-05-28 22:33:02,137",
        "eid": 3571,
        "data": {
          "file": "C:\\Windows\\System32\\WaaSMedicPS.dll",
          "pathtofile": null,
          "moduleaddress": "0x18ceb640000"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,231",
        "eid": 3572,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\Interface\\{C85C21BB-5CCF-412A-B0CC-059A8A6AD0DF}\\ProxyStubClsid32\\(Default)",
          "content": "{607C052E-2B08-4548-BD1D-EB7665A34788}"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,247",
        "eid": 3573,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,247",
        "eid": 3574,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,247",
        "eid": 3575,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3576,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3577,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3578,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3579,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3580,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3581,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3582,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3583,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,262",
        "eid": 3584,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "delete",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,293",
        "eid": 3585,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,293",
        "eid": 3586,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,293",
        "eid": 3587,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,293",
        "eid": 3588,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,293",
        "eid": 3589,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,293",
        "eid": 3590,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,293",
        "eid": 3591,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3592,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3593,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3594,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3595,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3596,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3597,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3598,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3599,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,309",
        "eid": 3600,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "delete",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,340",
        "eid": 3601,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,340",
        "eid": 3602,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,340",
        "eid": 3603,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,340",
        "eid": 3604,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,340",
        "eid": 3605,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,340",
        "eid": 3606,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,340",
        "eid": 3607,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,356",
        "eid": 3608,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,356",
        "eid": 3609,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,356",
        "eid": 3610,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,356",
        "eid": 3611,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,356",
        "eid": 3612,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,356",
        "eid": 3613,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,356",
        "eid": 3614,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,372",
        "eid": 3615,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,372",
        "eid": 3616,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "delete",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3617,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3618,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3619,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3620,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3621,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3622,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3623,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3624,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3625,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3626,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,387",
        "eid": 3627,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,403",
        "eid": 3628,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,403",
        "eid": 3629,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,403",
        "eid": 3630,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,403",
        "eid": 3631,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,403",
        "eid": 3632,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "delete",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3633,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3634,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3635,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3636,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3637,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3638,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3639,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3640,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3641,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3642,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3643,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3644,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,418",
        "eid": 3645,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,434",
        "eid": 3646,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,434",
        "eid": 3647,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "delete",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,450",
        "eid": 3648,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,450",
        "eid": 3649,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,450",
        "eid": 3650,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": null
        }
      },
      {
        "event": "read",
        "object": "registry",
        "timestamp": "2026-05-28 22:33:02,450",
        "eid": 3651,
        "data": {
          "regkey": "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\WindowsUpdate\\Orchestrator\\Settings\\WuDefaultSlaInMinutes",
          "content": "2880"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,481",
        "eid": 3652,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,481",
        "eid": 3653,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,481",
        "eid": 3654,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3655,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3656,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3657,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3658,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3659,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3660,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3661,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "read",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3662,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3663,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3664,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3665,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      },
      {
        "event": "write",
        "object": "file",
        "timestamp": "2026-05-28 22:33:02,559",
        "eid": 3666,
        "data": {
          "file": "C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db"
        }
      }
    ],
    "encryptedbuffers": [],
    "network_map": {
      "endpoint_map": {},
      "http_host_map": {},
      "dns_intents": {},
      "http_requests": [],
      "winhttp_sessions": [],
      "com_activations": []
    }
  },
  "debug": {
    "log": "2026-05-28 18:30:47,626 [root] INFO: Date set to: 20260528T18:31:44, timeout set to: 200\n2026-05-28 18:31:44,004 [root] DEBUG: Starting analyzer from: C:\\2unxg6vp\n2026-05-28 18:31:44,005 [root] DEBUG: Storing results at: C:\\qkWlOOMgP\n2026-05-28 18:31:44,005 [root] DEBUG: Pipe server name: \\\\.\\PIPE\\yISllA\n2026-05-28 18:31:44,005 [root] DEBUG: Python path: C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64\n2026-05-28 18:31:44,005 [root] INFO: analysis running as an admin\n2026-05-28 18:31:44,005 [root] INFO: analysis package specified: \"edge\"\n2026-05-28 18:31:44,005 [root] DEBUG: importing analysis package module: \"modules.packages.edge\"...\n2026-05-28 18:31:44,007 [root] DEBUG: imported analysis package \"edge\"\n2026-05-28 18:31:44,008 [root] DEBUG: initializing analysis package \"edge\"...\n2026-05-28 18:31:44,009 [root] DEBUG: New location of moved file: https://sugarcraft.net/\n2026-05-28 18:31:44,010 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll option\n2026-05-28 18:31:44,010 [root] INFO: Analyzer: Package modules.packages.edge does not specify a dll_64 option\n2026-05-28 18:31:44,010 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader option\n2026-05-28 18:31:44,010 [root] INFO: Analyzer: Package modules.packages.edge does not specify a loader_64 option\n2026-05-28 18:31:44,030 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.browser\"\n2026-05-28 18:31:44,090 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.digisig\"\n2026-05-28 18:31:44,112 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.disguise\"\n2026-05-28 18:31:44,127 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.human\"\n2026-05-28 18:31:44,130 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'\n2026-05-28 18:31:44,131 [lib.api.screenshot] ERROR: No module named 'PIL'\n2026-05-28 18:31:44,131 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.screenshots\"\n2026-05-28 18:31:44,132 [root] DEBUG: Imported auxiliary module \"modules.auxiliary.tlsdump\"\n2026-05-28 18:31:44,133 [root] DEBUG: Initialized auxiliary module \"Browser\"\n2026-05-28 18:31:44,133 [root] DEBUG: attempting to configure 'Browser' from data\n2026-05-28 18:31:44,134 [root] DEBUG: module Browser does not support data configuration, ignoring\n2026-05-28 18:31:44,134 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.browser\"...\n2026-05-28 18:31:44,134 [root] DEBUG: Started auxiliary module modules.auxiliary.browser\n2026-05-28 18:31:44,135 [root] DEBUG: Initialized auxiliary module \"DigiSig\"\n2026-05-28 18:31:44,135 [root] DEBUG: attempting to configure 'DigiSig' from data\n2026-05-28 18:31:44,135 [root] DEBUG: module DigiSig does not support data configuration, ignoring\n2026-05-28 18:31:44,135 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.digisig\"...\n2026-05-28 18:31:44,135 [modules.auxiliary.digisig] DEBUG: Skipping authenticode validation, analysis is not a file\n2026-05-28 18:31:44,135 [root] DEBUG: Started auxiliary module modules.auxiliary.digisig\n2026-05-28 18:31:44,136 [root] DEBUG: Initialized auxiliary module \"Disguise\"\n2026-05-28 18:31:44,136 [root] DEBUG: attempting to configure 'Disguise' from data\n2026-05-28 18:31:44,136 [root] DEBUG: module Disguise does not support data configuration, ignoring\n2026-05-28 18:31:44,136 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.disguise\"...\n2026-05-28 18:31:44,138 [modules.auxiliary.disguise] INFO: Launched background process notepad.exe hidden (PID: 4828)\n2026-05-28 18:31:44,138 [modules.auxiliary.disguise] INFO: Disguising GUID to 91524b71-1c67-410a-aa95-1d6d743ad05d\n2026-05-28 18:31:44,139 [root] DEBUG: Started auxiliary module modules.auxiliary.disguise\n2026-05-28 18:31:44,139 [root] DEBUG: Initialized auxiliary module \"Human\"\n2026-05-28 18:31:44,139 [root] DEBUG: attempting to configure 'Human' from data\n2026-05-28 18:31:44,139 [root] DEBUG: module Human does not support data configuration, ignoring\n2026-05-28 18:31:44,139 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.human\"...\n2026-05-28 18:31:44,140 [root] DEBUG: Started auxiliary module modules.auxiliary.human\n2026-05-28 18:31:44,140 [root] DEBUG: Initialized auxiliary module \"Screenshots\"\n2026-05-28 18:31:44,140 [root] DEBUG: attempting to configure 'Screenshots' from data\n2026-05-28 18:31:44,140 [root] DEBUG: module Screenshots does not support data configuration, ignoring\n2026-05-28 18:31:44,140 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.screenshots\"...\n2026-05-28 18:31:44,141 [modules.auxiliary.screenshots] WARNING: Python Image Library is not installed, screenshots are disabled\n2026-05-28 18:31:44,141 [root] DEBUG: Started auxiliary module modules.auxiliary.screenshots\n2026-05-28 18:31:44,141 [root] DEBUG: Initialized auxiliary module \"TLSDumpMasterSecrets\"\n2026-05-28 18:31:44,141 [root] DEBUG: attempting to configure 'TLSDumpMasterSecrets' from data\n2026-05-28 18:31:44,141 [root] DEBUG: module TLSDumpMasterSecrets does not support data configuration, ignoring\n2026-05-28 18:31:44,141 [root] DEBUG: Trying to start auxiliary module \"modules.auxiliary.tlsdump\"...\n2026-05-28 18:31:44,143 [modules.auxiliary.tlsdump] WARNING: Unable to find lsass.exe process\n2026-05-28 18:31:44,143 [root] DEBUG: Started auxiliary module modules.auxiliary.tlsdump\n2026-05-28 18:31:44,143 [root] INFO: Interactive mode enabled - injecting into explorer shell\n2026-05-28 18:31:44,168 [lib.api.process] INFO: Monitor config for process 4676: C:\\2unxg6vp\\dll\\4676.ini\n2026-05-28 18:31:44,169 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:44,171 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:44,197 [root] DEBUG: Loader: Injecting process 4676 with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:44,379 [root] DEBUG: 4676: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:31:44,382 [root] DEBUG: 4676: Disabling sleep skipping.\n2026-05-28 18:31:44,385 [root] DEBUG: 4676: Interactive desktop enabled.\n2026-05-28 18:31:44,387 [root] DEBUG: 4676: Dropped file limit defaulting to 100.\n2026-05-28 18:31:44,388 [root] DEBUG: 4676: Interactive desktop - injecting Explorer Shell\n2026-05-28 18:31:44,398 [root] DEBUG: 4676: YaraInit: Compiled 44 rule files\n2026-05-28 18:31:44,401 [root] DEBUG: 4676: YaraInit: Compiled rules saved to file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:31:44,436 [root] DEBUG: 4676: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:31:44,437 [root] DEBUG: 4676: YaraScan: Scanning 0x00007FF663980000, size 0x545316\n2026-05-28 18:31:44,482 [root] DEBUG: 4676: Monitor initialised: 64-bit capemon loaded in process 4676 at 0x00007FFF52E70000, thread 9116, image base 0x00007FF663980000, stack from 0x0000000010E52000-0x0000000010E60000\n2026-05-28 18:31:44,483 [root] DEBUG: 4676: Commandline: C:\\Windows\\Explorer.EXE\n2026-05-28 18:31:44,495 [root] DEBUG: 4676: Hooked 69 out of 69 functions\n2026-05-28 18:31:44,525 [root] DEBUG: 4676: Syscall hook installed, syscall logging level 1\n2026-05-28 18:31:44,532 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 18:31:44,532 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:44,533 [lib.api.process] INFO: Injected into 64-bit <Process 4676 explorer.exe>\n2026-05-28 18:31:54,599 [root] DEBUG: 4676: YaraScan: Scanning 0x00007FF663980000, size 0x545316\n2026-05-28 18:31:54,633 [root] DEBUG: 4676: caller_dispatch: Added region at 0x00007FF663980000 to tracked regions list (combase::CoCreateInstance returns to 0x00007FF663A28FBA, thread 4824).\n2026-05-28 18:31:54,636 [root] DEBUG: 4676: YaraScan: Scanning 0x00007FF663980000, size 0x545316\n2026-05-28 18:31:54,673 [root] DEBUG: 4676: ProcessImageBase: Main module image at 0x00007FF663980000 unmodified (entropy change 1.067672e-06)\n2026-05-28 18:31:54,679 [root] DEBUG: 4676: ProcessImageBase: Main module image at 0x00007FF663980000 unmodified (entropy change 5.913137e-06)\n2026-05-28 18:31:54,936 [root] INFO: Restarting WMI Service\n2026-05-28 18:31:56,990 [root] DEBUG: package modules.packages.edge does not support configure, ignoring\n2026-05-28 18:31:56,992 [root] WARNING: configuration error for package modules.packages.edge: error importing data.packages.edge: No module named 'data.packages'\n2026-05-28 18:31:56,993 [lib.core.compound] INFO: C:\\Users\\admin\\AppData\\Local\\Temp already exists, skipping creation\n2026-05-28 18:31:56,998 [lib.api.process] INFO: Successfully executed process from path \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" with arguments \"\"https://sugarcraft.net/\"\" with pid 7284\n2026-05-28 18:31:56,999 [lib.api.process] INFO: Monitor config for process 7284: C:\\2unxg6vp\\dll\\7284.ini\n2026-05-28 18:31:57,002 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:57,005 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:57,014 [root] DEBUG: Loader: Injecting process 7284 (thread 7496) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:57,014 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:31:57,015 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:57,016 [lib.api.process] INFO: Injected into 64-bit <Process 7284 msedge.exe>\n2026-05-28 18:31:57,284 [lib.api.process] INFO: Monitor config for process 840: C:\\2unxg6vp\\dll\\840.ini\n2026-05-28 18:31:57,285 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:57,286 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:57,290 [root] DEBUG: Loader: Injecting process 840 with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:57,293 [root] DEBUG: 840: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:31:57,293 [root] DEBUG: 840: Disabling sleep skipping.\n2026-05-28 18:31:57,294 [root] DEBUG: 840: Interactive desktop enabled.\n2026-05-28 18:31:57,294 [root] DEBUG: 840: Dropped file limit defaulting to 100.\n2026-05-28 18:31:57,295 [root] DEBUG: 840: Services hook set enabled\n2026-05-28 18:31:57,298 [root] DEBUG: 840: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:31:57,311 [root] DEBUG: 840: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:31:57,311 [root] DEBUG: 840: Monitor initialised: 64-bit capemon loaded in process 840 at 0x00007FFF52E70000, thread 7192, image base 0x00007FF71F590000, stack from 0x000000B0F6374000-0x000000B0F6380000\n2026-05-28 18:31:57,312 [root] DEBUG: 840: Commandline: C:\\Windows\\system32\\svchost.exe -k DcomLaunch -p\n2026-05-28 18:31:57,324 [root] DEBUG: 840: Hooked 69 out of 69 functions\n2026-05-28 18:31:57,325 [root] INFO: Loaded monitor into process with pid 840\n2026-05-28 18:31:57,326 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 18:31:57,326 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:57,327 [lib.api.process] INFO: Injected into 64-bit <Process 840 svchost.exe>\n2026-05-28 18:31:59,032 [lib.api.process] INFO: Successfully resumed process with pid 7284\n2026-05-28 18:31:59,049 [root] DEBUG: 4676: CreateProcessHandler: Injection info set for new process 8372: C:\\Windows\\system32\\msinfo32.exe, ImageBase: 0x00007FF726AD0000\n2026-05-28 18:31:59,050 [root] INFO: Announced 64-bit process name: msinfo32.exe pid: 8372\n2026-05-28 18:31:59,050 [lib.api.process] INFO: Monitor config for process 8372: C:\\2unxg6vp\\dll\\8372.ini\n2026-05-28 18:31:59,051 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,052 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,057 [root] DEBUG: Loader: Injecting process 8372 (thread 7460) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,058 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:31:59,059 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,060 [lib.api.process] INFO: Injected into 64-bit <Process 8372 msinfo32.exe>\n2026-05-28 18:31:59,062 [root] INFO: Announced 64-bit process name: msinfo32.exe pid: 8372\n2026-05-28 18:31:59,062 [lib.api.process] INFO: Monitor config for process 8372: C:\\2unxg6vp\\dll\\8372.ini\n2026-05-28 18:31:59,063 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,063 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,069 [root] DEBUG: Loader: Injecting process 8372 (thread 7460) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,070 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:31:59,070 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,072 [lib.api.process] INFO: Injected into 64-bit <Process 8372 msinfo32.exe>\n2026-05-28 18:31:59,080 [root] INFO: Announced 64-bit process name: msinfo32.exe pid: 8372\n2026-05-28 18:31:59,081 [lib.api.process] INFO: Monitor config for process 8372: C:\\2unxg6vp\\dll\\8372.ini\n2026-05-28 18:31:59,083 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,086 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,088 [root] DEBUG: 7284: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:31:59,089 [root] DEBUG: 4676: DLL loaded at 0x00007FFF7C210000: C:\\Windows\\System32\\windows.internal.shell.broker (0xdd000 bytes).\n2026-05-28 18:31:59,091 [root] DEBUG: 7284: Disabling sleep skipping.\n2026-05-28 18:31:59,091 [root] DEBUG: Loader: Injecting process 8372 with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,091 [root] DEBUG: 7284: Interactive desktop enabled.\n2026-05-28 18:31:59,092 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 7460, handle 0x120\n2026-05-28 18:31:59,092 [root] DEBUG: 7284: Dropped file limit defaulting to 100.\n2026-05-28 18:31:59,093 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 18:31:59,093 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,096 [lib.api.process] INFO: Injected into 64-bit <Process 8372 msinfo32.exe>\n2026-05-28 18:31:59,101 [root] DEBUG: 7284: Edge-specific hook-set enabled.\n2026-05-28 18:31:59,104 [root] DEBUG: 7284: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:31:59,109 [root] DEBUG: 8372: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:31:59,110 [root] DEBUG: 8372: Interactive desktop enabled.\n2026-05-28 18:31:59,110 [root] DEBUG: 8372: Dropped file limit defaulting to 100.\n2026-05-28 18:31:59,113 [root] DEBUG: 8372: Disabling sleep skipping.\n2026-05-28 18:31:59,114 [root] DEBUG: 8372: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:31:59,116 [root] DEBUG: 7284: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:31:59,116 [root] DEBUG: 7284: Monitor initialised: 64-bit capemon loaded in process 7284 at 0x00007FFF52E70000, thread 7496, image base 0x00007FF6F9430000, stack from 0x000000F98C3F4000-0x000000F98C400000\n2026-05-28 18:31:59,117 [root] DEBUG: 7284: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" \"https://sugarcraft.net/\"\n2026-05-28 18:31:59,127 [root] DEBUG: 7284: Hooked 2 out of 2 functions\n2026-05-28 18:31:59,128 [root] DEBUG: 8372: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:31:59,128 [root] DEBUG: 8372: YaraScan: Scanning 0x00007FF726AD0000, size 0x66322\n2026-05-28 18:31:59,130 [root] DEBUG: 8372: Monitor initialised: 64-bit capemon loaded in process 8372 at 0x00007FFF52E70000, thread 7460, image base 0x00007FF726AD0000, stack from 0x0000009D40CD4000-0x0000009D40CE0000\n2026-05-28 18:31:59,131 [root] DEBUG: 8372: Commandline: \"C:\\Windows\\system32\\msinfo32.exe\"\n2026-05-28 18:31:59,140 [root] DEBUG: 8372: hook_api: LdrpCallInitRoutine export address 0x00007FFF98C699BC obtained via GetFunctionAddress\n2026-05-28 18:31:59,162 [root] DEBUG: 7284: Syscall hook installed, syscall logging level 1\n2026-05-28 18:31:59,166 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 18:31:59,167 [root] DEBUG: 8372: set_hooks: Unable to hook LockResource\n2026-05-28 18:31:59,168 [root] DEBUG: 7284: RestoreHeaders: Restored original import table.\n2026-05-28 18:31:59,168 [root] INFO: Loaded monitor into process with pid 7284\n2026-05-28 18:31:59,172 [root] DEBUG: 8372: Hooked 627 out of 628 functions\n2026-05-28 18:31:59,172 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-28 18:31:59,174 [root] DEBUG: 8372: Syscall hook installed, syscall logging level 1\n2026-05-28 18:31:59,178 [root] DEBUG: 7284: DLL loaded at 0x00007FFF853A0000: C:\\Windows\\SYSTEM32\\version (0xa000 bytes).\n2026-05-28 18:31:59,179 [root] DEBUG: 8372: RestoreHeaders: Restored original import table.\n2026-05-28 18:31:59,179 [root] DEBUG: 7284: DLL loaded at 0x00007FFF984B0000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 18:31:59,179 [root] INFO: Loaded monitor into process with pid 8372\n2026-05-28 18:31:59,181 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95CA0000: C:\\Windows\\SYSTEM32\\Wldp (0x2d000 bytes).\n2026-05-28 18:31:59,181 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94410000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-28 18:31:59,182 [root] DEBUG: 7284: DLL loaded at 0x00007FFF984B0000: C:\\Windows\\System32\\SHCORE (0xad000 bytes).\n2026-05-28 18:31:59,183 [root] DEBUG: 8372: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 18:31:59,184 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95450000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 18:31:59,194 [root] DEBUG: 8372: DLL loaded at 0x00007FFF96170000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-28 18:31:59,198 [root] DEBUG: 8372: caller_dispatch: Added region at 0x00007FF726AD0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF726AF1A71, thread 7460).\n2026-05-28 18:31:59,199 [root] DEBUG: 8372: YaraScan: Scanning 0x00007FF726AD0000, size 0x66322\n2026-05-28 18:31:59,203 [root] DEBUG: 8372: ProcessImageBase: Main module image at 0x00007FF726AD0000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:31:59,206 [root] DEBUG: 8372: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:31:59,208 [root] DEBUG: 8372: DLL loaded at 0x00007FFF93CF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 18:31:59,216 [root] DEBUG: 8372: DLL loaded at 0x00007FFF97F00000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 18:31:59,262 [root] DEBUG: 8372: DLL loaded at 0x00007FFF87FF0000: C:\\Windows\\system32\\TextShaping (0xac000 bytes).\n2026-05-28 18:31:59,317 [lib.api.process] INFO: Monitor config for process 5020: C:\\2unxg6vp\\dll\\5020.ini\n2026-05-28 18:31:59,321 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,323 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,326 [root] DEBUG: 7284: DLL loaded at 0x00007FFF84A60000: C:\\Windows\\SYSTEM32\\WINMM (0x27000 bytes).\n2026-05-28 18:31:59,327 [root] DEBUG: 7284: DLL loaded at 0x00007FFF3EE40000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-28 18:31:59,328 [root] DEBUG: Loader: Injecting process 5020 with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,330 [root] DEBUG: 7284: DLL loaded at 0x00007FFF833E0000: C:\\Windows\\SYSTEM32\\KBDUS (0x9000 bytes).\n2026-05-28 18:31:59,330 [root] DEBUG: 5020: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:31:59,331 [root] DEBUG: 5020: Disabling sleep skipping.\n2026-05-28 18:31:59,331 [root] DEBUG: 8372: DLL loaded at 0x00007FFF95450000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 18:31:59,331 [root] DEBUG: 5020: Interactive desktop enabled.\n2026-05-28 18:31:59,331 [root] DEBUG: 8372: DLL loaded at 0x00007FFF93840000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 18:31:59,332 [root] DEBUG: 5020: Dropped file limit defaulting to 100.\n2026-05-28 18:31:59,332 [root] DEBUG: 7284: DLL loaded at 0x00007FFF93CF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 18:31:59,333 [root] DEBUG: 5020: Services hook set enabled\n2026-05-28 18:31:59,333 [root] DEBUG: 8372: DLL loaded at 0x00007FFF92180000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 18:31:59,334 [root] DEBUG: 8372: DLL loaded at 0x00007FFF93160000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-28 18:31:59,334 [root] DEBUG: 8372: DLL loaded at 0x00007FFF8A6E0000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-28 18:31:59,336 [root] DEBUG: 5020: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:31:59,338 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:31:59,338 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 5600: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:31:59,338 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 5600\n2026-05-28 18:31:59,339 [root] DEBUG: 7284: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:31:59,339 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 5600\n2026-05-28 18:31:59,340 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8D840000: C:\\Windows\\System32\\Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings (0x16000 bytes).\n2026-05-28 18:31:59,341 [root] DEBUG: 7284: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:31:59,342 [root] DEBUG: 7284: DLL loaded at 0x00007FFF90020000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 18:31:59,346 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96220000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 18:31:59,347 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94BC0000: C:\\Windows\\SYSTEM32\\gpapi (0x23000 bytes).\n2026-05-28 18:31:59,347 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95490000: C:\\Windows\\SYSTEM32\\wkscli (0x19000 bytes).\n2026-05-28 18:31:59,351 [root] DEBUG: 5020: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:31:59,352 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95850000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-28 18:31:59,355 [root] DEBUG: 5020: Monitor initialised: 64-bit capemon loaded in process 5020 at 0x00007FFF52E70000, thread 668, image base 0x00007FF71F590000, stack from 0x000000E4C4DF4000-0x000000E4C4E00000\n2026-05-28 18:31:59,357 [root] DEBUG: 7284: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:31:59,358 [root] DEBUG: 5020: Commandline: C:\\Windows\\system32\\svchost.exe -k netsvcs -p\n2026-05-28 18:31:59,359 [root] DEBUG: 7284: DLL loaded at 0x00007FFF7FD70000: C:\\Windows\\SYSTEM32\\MDMRegistration (0x68000 bytes).\n2026-05-28 18:31:59,361 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96190000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 18:31:59,362 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95BF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 18:31:59,364 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95D10000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 18:31:59,365 [root] DEBUG: 7284: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:31:59,366 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 18:31:59,366 [root] DEBUG: 7284: DLL loaded at 0x00007FFF82660000: C:\\Windows\\SYSTEM32\\DMCmnUtils (0x7c000 bytes).\n2026-05-28 18:31:59,367 [root] DEBUG: 7284: DLL loaded at 0x00007FFF82E70000: C:\\Windows\\SYSTEM32\\omadmapi (0x3a000 bytes).\n2026-05-28 18:31:59,370 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96170000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 18:31:59,371 [root] DEBUG: 5020: Hooked 69 out of 69 functions\n2026-05-28 18:31:59,372 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95CD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 18:31:59,372 [root] INFO: Loaded monitor into process with pid 5020\n2026-05-28 18:31:59,373 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 18:31:59,374 [root] DEBUG: 7284: DLL loaded at 0x00007FFF85400000: C:\\Windows\\SYSTEM32\\netapi32 (0x19000 bytes).\n2026-05-28 18:31:59,374 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,375 [root] DEBUG: 7284: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:31:59,375 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95BF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-28 18:31:59,375 [lib.api.process] INFO: Injected into 64-bit <Process 5020 svchost.exe>\n2026-05-28 18:31:59,376 [root] DEBUG: 7284: DLL loaded at 0x00007FFF92030000: C:\\Windows\\SYSTEM32\\DSREG (0x141000 bytes).\n2026-05-28 18:31:59,377 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96260000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 18:31:59,390 [root] DEBUG: 4676: CreateProcessHandler: Injection info set for new process 2380: C:\\Windows\\system32\\msinfo32.exe, ImageBase: 0x00007FF726AD0000\n2026-05-28 18:31:59,390 [root] INFO: Announced 64-bit process name: msinfo32.exe pid: 2380\n2026-05-28 18:31:59,390 [lib.api.process] INFO: Monitor config for process 2380: C:\\2unxg6vp\\dll\\2380.ini\n2026-05-28 18:31:59,391 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,392 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,397 [root] DEBUG: Loader: Injecting process 2380 (thread 2404) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,397 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:31:59,397 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,399 [lib.api.process] INFO: Injected into 64-bit <Process 2380 msinfo32.exe>\n2026-05-28 18:31:59,400 [root] INFO: Announced 64-bit process name: msinfo32.exe pid: 2380\n2026-05-28 18:31:59,401 [lib.api.process] INFO: Monitor config for process 2380: C:\\2unxg6vp\\dll\\2380.ini\n2026-05-28 18:31:59,401 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,402 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,406 [root] DEBUG: Loader: Injecting process 2380 (thread 2404) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,406 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:31:59,406 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,408 [lib.api.process] INFO: Injected into 64-bit <Process 2380 msinfo32.exe>\n2026-05-28 18:31:59,408 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8D820000: C:\\Windows\\System32\\AssignedAccessRuntime (0x14000 bytes).\n2026-05-28 18:31:59,409 [root] INFO: Announced 64-bit process name: msinfo32.exe pid: 2380\n2026-05-28 18:31:59,409 [root] DEBUG: 7284: DLL loaded at 0x00007FFF97F00000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 18:31:59,409 [lib.api.process] INFO: Monitor config for process 2380: C:\\2unxg6vp\\dll\\2380.ini\n2026-05-28 18:31:59,410 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,410 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8CEF0000: C:\\Windows\\System32\\SystemSettings.DataModel (0x74000 bytes).\n2026-05-28 18:31:59,411 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,411 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96190000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 18:31:59,412 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96170000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 18:31:59,413 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8A140000: C:\\Windows\\SYSTEM32\\DWrite (0x27f000 bytes).\n2026-05-28 18:31:59,416 [root] DEBUG: Loader: Injecting process 2380 with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,417 [root] DEBUG: InjectDll: No thread ID supplied, initial thread ID 2404, handle 0x120\n2026-05-28 18:31:59,417 [root] DEBUG: 7284: DLL loaded at 0x00007FFF82ED0000: C:\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\\COMCTL32 (0x29a000 bytes).\n2026-05-28 18:31:59,418 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 18:31:59,418 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,419 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8F850000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 18:31:59,422 [root] DEBUG: 7284: DLL loaded at 0x00007FFF960B0000: C:\\Windows\\SYSTEM32\\DPAPI (0xa000 bytes).\n2026-05-28 18:31:59,423 [lib.api.process] INFO: Injected into 64-bit <Process 2380 msinfo32.exe>\n2026-05-28 18:31:59,424 [root] DEBUG: 7284: DLL loaded at 0x00007FFF956F0000: C:\\Windows\\SYSTEM32\\IPHLPAPI (0x3b000 bytes).\n2026-05-28 18:31:59,424 [root] DEBUG: 7284: DLL loaded at 0x00007FFF91940000: C:\\Windows\\system32\\NLAapi (0x1d000 bytes).\n2026-05-28 18:31:59,426 [root] DEBUG: 7284: DLL loaded at 0x00007FFF98020000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-28 18:31:59,426 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96AF0000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-28 18:31:59,427 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8BEB0000: C:\\Windows\\System32\\StructuredQuery (0xa6000 bytes).\n2026-05-28 18:31:59,428 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8EAD0000: C:\\Windows\\SYSTEM32\\dhcpcsvc6 (0x17000 bytes).\n2026-05-28 18:31:59,429 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8EAB0000: C:\\Windows\\SYSTEM32\\dhcpcsvc (0x1d000 bytes).\n2026-05-28 18:31:59,429 [root] DEBUG: 7284: DLL loaded at 0x00007FFF91EB0000: C:\\Windows\\SYSTEM32\\PROPSYS (0xf6000 bytes).\n2026-05-28 18:31:59,430 [root] DEBUG: 2380: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:31:59,430 [root] DEBUG: 2380: Interactive desktop enabled.\n2026-05-28 18:31:59,430 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95730000: C:\\Windows\\SYSTEM32\\DNSAPI (0xca000 bytes).\n2026-05-28 18:31:59,431 [root] DEBUG: 2380: Dropped file limit defaulting to 100.\n2026-05-28 18:31:59,432 [root] DEBUG: 2380: Disabling sleep skipping.\n2026-05-28 18:31:59,433 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8B820000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-28 18:31:59,433 [root] DEBUG: 2380: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:31:59,436 [root] DEBUG: 7284: DLL loaded at 0x00007FFF93840000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 18:31:59,436 [root] DEBUG: 7284: DLL loaded at 0x00007FFF92180000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 18:31:59,437 [root] DEBUG: 7284: DLL loaded at 0x00007FFF93160000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-28 18:31:59,437 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8A6E0000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-28 18:31:59,438 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8B750000: C:\\Windows\\system32\\Windows.Storage.Search (0xc6000 bytes).\n2026-05-28 18:31:59,440 [root] DEBUG: 7284: DLL loaded at 0x00007FFF90DA0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 18:31:59,442 [root] DEBUG: 7284: DLL loaded at 0x00007FFF82BC0000: C:\\Windows\\system32\\twinapi (0xa9000 bytes).\n2026-05-28 18:31:59,443 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8A550000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-28 18:31:59,445 [root] DEBUG: 7284: DLL loaded at 0x00007FFF905B0000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-28 18:31:59,445 [root] DEBUG: 2380: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:31:59,446 [root] DEBUG: 2380: YaraScan: Scanning 0x00007FF726AD0000, size 0x66322\n2026-05-28 18:31:59,448 [root] DEBUG: 2380: Monitor initialised: 64-bit capemon loaded in process 2380 at 0x00007FFF52E70000, thread 2404, image base 0x00007FF726AD0000, stack from 0x000000DDD5594000-0x000000DDD55A0000\n2026-05-28 18:31:59,449 [root] DEBUG: 7284: DLL loaded at 0x00007FFF86740000: C:\\Windows\\SYSTEM32\\edputil (0x24000 bytes).\n2026-05-28 18:31:59,449 [root] DEBUG: 2380: Commandline: \"C:\\Windows\\system32\\msinfo32.exe\"\n2026-05-28 18:31:59,451 [root] DEBUG: 7284: DLL loaded at 0x00007FFF90FB0000: C:\\Windows\\System32\\WindowManagementAPI (0xa1000 bytes).\n2026-05-28 18:31:59,452 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8A580000: C:\\Windows\\System32\\InputHost (0x152000 bytes).\n2026-05-28 18:31:59,452 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8A7E0000: C:\\Windows\\System32\\Windows.UI (0x141000 bytes).\n2026-05-28 18:31:59,456 [root] DEBUG: 7284: DLL loaded at 0x00007FFF91FE0000: C:\\Windows\\SYSTEM32\\WTSAPI32 (0x14000 bytes).\n2026-05-28 18:31:59,457 [root] DEBUG: 7284: DLL loaded at 0x00007FFF90620000: C:\\Windows\\SYSTEM32\\ColorAdapterClient (0x11000 bytes).\n2026-05-28 18:31:59,458 [root] DEBUG: 7284: DLL loaded at 0x00007FFF90660000: C:\\Windows\\SYSTEM32\\mscms (0xae000 bytes).\n2026-05-28 18:31:59,459 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8C3B0000: C:\\Windows\\System32\\iertutil (0x2bc000 bytes).\n2026-05-28 18:31:59,460 [root] DEBUG: 7284: DLL loaded at 0x00007FFF865D0000: C:\\Windows\\System32\\Windows.Web (0xc3000 bytes).\n2026-05-28 18:31:59,461 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95FF0000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-28 18:31:59,463 [root] DEBUG: 2380: hook_api: LdrpCallInitRoutine export address 0x00007FFF98C699BC obtained via GetFunctionAddress\n2026-05-28 18:31:59,468 [root] DEBUG: 7284: DLL loaded at 0x00007FFF90780000: C:\\Windows\\SYSTEM32\\WINHTTP (0x10a000 bytes).\n2026-05-28 18:31:59,473 [root] INFO: Announced starting service \"b'MicrosoftEdgeElevationService'\"\n2026-05-28 18:31:59,473 [lib.api.process] INFO: Monitor config for process 672: C:\\2unxg6vp\\dll\\672.ini\n2026-05-28 18:31:59,474 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:31:59,475 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:31:59,486 [root] DEBUG: 7284: DLL loaded at 0x00007FFF3D4E0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneauth (0x5c4000 bytes).\n2026-05-28 18:31:59,487 [root] DEBUG: Loader: Injecting process 672 with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,489 [root] DEBUG: Loader: Copied config file C:\\2unxg6vp\\dll\\672.ini to system path C:\\672.ini\n2026-05-28 18:31:59,491 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 18:31:59,491 [root] DEBUG: 2380: set_hooks: Unable to hook LockResource\n2026-05-28 18:31:59,493 [root] DEBUG: Loader: Unable to open process, launched: PPLinject64.exe 672 C:\\2unxg6vp\\dll\\qmRoKOe.dll\n2026-05-28 18:31:59,494 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:31:59,496 [lib.api.process] INFO: Injected into 64-bit <Process 672 services.exe>\n2026-05-28 18:31:59,497 [root] DEBUG: 2380: Hooked 627 out of 628 functions\n2026-05-28 18:31:59,497 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8A3C0000: C:\\Windows\\System32\\Windows.UI.Immersive (0x139000 bytes).\n2026-05-28 18:31:59,498 [root] DEBUG: 7284: DLL loaded at 0x00007FFF87320000: C:\\Windows\\SYSTEM32\\Secur32 (0xc000 bytes).\n2026-05-28 18:31:59,501 [root] DEBUG: 2380: Syscall hook installed, syscall logging level 1\n2026-05-28 18:31:59,501 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 8728: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:31:59,502 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 8728\n2026-05-28 18:31:59,503 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 8728\n2026-05-28 18:31:59,503 [root] DEBUG: 7284: caller_dispatch: Added region at 0x00007FF6F9430000 to tracked regions list (kernel32::CreateProcessInternalW returns to 0x00007FF6F9527D66, thread 2744).\n2026-05-28 18:31:59,508 [root] DEBUG: 2380: RestoreHeaders: Restored original import table.\n2026-05-28 18:31:59,508 [root] DEBUG: 7284: ProcessImageBase: Main module image at 0x00007FF6F9430000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:31:59,518 [root] INFO: Loaded monitor into process with pid 2380\n2026-05-28 18:31:59,525 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 9256: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:31:59,532 [root] DEBUG: 2380: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 18:31:59,534 [root] DEBUG: 7284: DLL loaded at 0x00007FFF853F0000: C:\\Windows\\SYSTEM32\\LINKINFO (0xd000 bytes).\n2026-05-28 18:31:59,534 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 9276: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:31:59,538 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9256\n2026-05-28 18:31:59,541 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9276\n2026-05-28 18:31:59,542 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9256\n2026-05-28 18:31:59,551 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9276\n2026-05-28 18:31:59,552 [root] DEBUG: 2380: DLL loaded at 0x00007FFF96170000: C:\\Windows\\system32\\UMPDC (0x12000 bytes).\n2026-05-28 18:31:59,578 [root] DEBUG: 2380: caller_dispatch: Added region at 0x00007FF726AD0000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF726AF1A71, thread 2404).\n2026-05-28 18:31:59,584 [root] DEBUG: 2380: YaraScan: Scanning 0x00007FF726AD0000, size 0x66322\n2026-05-28 18:31:59,595 [root] DEBUG: 2380: ProcessImageBase: Main module image at 0x00007FF726AD0000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:31:59,599 [root] DEBUG: 2380: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:31:59,603 [root] DEBUG: 2380: DLL loaded at 0x00007FFF93CF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 18:31:59,618 [root] DEBUG: 2380: DLL loaded at 0x00007FFF97F00000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 18:31:59,620 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94BF0000: C:\\Windows\\system32\\dxgi (0xf3000 bytes).\n2026-05-28 18:31:59,622 [root] DEBUG: 7284: DLL loaded at 0x00007FFF92740000: C:\\Windows\\system32\\d3d11 (0x263000 bytes).\n2026-05-28 18:31:59,625 [root] DEBUG: 7284: DLL loaded at 0x00007FFF929B0000: C:\\Windows\\system32\\dcomp (0x1e3000 bytes).\n2026-05-28 18:31:59,626 [root] DEBUG: 7284: DLL loaded at 0x00007FFF80590000: C:\\Windows\\system32\\dataexchange (0x3e000 bytes).\n2026-05-28 18:31:59,661 [root] DEBUG: 2380: DLL loaded at 0x00007FFF87FF0000: C:\\Windows\\system32\\TextShaping (0xac000 bytes).\n2026-05-28 18:31:59,705 [root] DEBUG: 2380: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:31:59,706 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8D6A0000: C:\\Windows\\System32\\Windows.System.Profile.RetailInfo (0x28000 bytes).\n2026-05-28 18:31:59,716 [root] DEBUG: 2380: DLL loaded at 0x00007FFF95450000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 18:31:59,720 [root] DEBUG: 2380: DLL loaded at 0x00007FFF93840000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 18:31:59,720 [root] DEBUG: 2380: DLL loaded at 0x00007FFF92180000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 18:31:59,721 [root] DEBUG: 2380: DLL loaded at 0x00007FFF93160000: C:\\Windows\\System32\\CoreUIComponents (0x35b000 bytes).\n2026-05-28 18:31:59,721 [root] DEBUG: 2380: DLL loaded at 0x00007FFF8A6E0000: C:\\Windows\\SYSTEM32\\textinputframework (0xf9000 bytes).\n2026-05-28 18:31:59,723 [root] DEBUG: 2380: DLL loaded at 0x00007FFF8CFE0000: C:\\Windows\\SYSTEM32\\wbemcomn (0x90000 bytes).\n2026-05-28 18:31:59,723 [root] DEBUG: 2380: DLL loaded at 0x00007FFF82DC0000: C:\\Windows\\system32\\wbem\\wbemprox (0x11000 bytes).\n2026-05-28 18:31:59,733 [root] DEBUG: 2380: Successfully installed hook on COM Object function WbemLocator_ConnectServer\n2026-05-28 18:31:59,746 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 9620: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:31:59,747 [root] DEBUG: 7284: DLL loaded at 0x00007FFF80840000: C:\\Windows\\SYSTEM32\\OLEACC (0x66000 bytes).\n2026-05-28 18:31:59,748 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 9648: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:31:59,752 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9620\n2026-05-28 18:31:59,753 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9648\n2026-05-28 18:31:59,756 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9620\n2026-05-28 18:31:59,757 [root] DEBUG: 7284: DLL loaded at 0x00007FFF877F0000: C:\\Windows\\system32\\directmanipulation (0x9d000 bytes).\n2026-05-28 18:31:59,758 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 9648\n2026-05-28 18:31:59,761 [root] DEBUG: 5020: DLL loaded at 0x00007FFF8C090000: C:\\Windows\\SYSTEM32\\VssTrace (0x18000 bytes).\n2026-05-28 18:31:59,767 [root] DEBUG: 5020: DLL loaded at 0x00007FFF8C0B0000: C:\\Windows\\SYSTEM32\\vssapi (0x19e000 bytes).\n2026-05-28 18:31:59,771 [root] DEBUG: 5020: DLL loaded at 0x00007FFF8C070000: C:\\Windows\\SYSTEM32\\samcli (0x19000 bytes).\n2026-05-28 18:31:59,773 [root] DEBUG: 5020: DLL loaded at 0x00007FFF95850000: C:\\Windows\\SYSTEM32\\netutils (0xc000 bytes).\n2026-05-28 18:31:59,779 [root] DEBUG: 5020: DLL loaded at 0x00007FFF91FB0000: C:\\Windows\\SYSTEM32\\SAMLIB (0x28000 bytes).\n2026-05-28 18:31:59,781 [root] DEBUG: 5020: DLL loaded at 0x00007FFF8E940000: C:\\Windows\\System32\\ES (0x6c000 bytes).\n2026-05-28 18:31:59,792 [root] DEBUG: 5020: DLL loaded at 0x00007FFF91EB0000: C:\\Windows\\System32\\PROPSYS (0xf6000 bytes).\n2026-05-28 18:31:59,796 [root] DEBUG: 5020: DLL loaded at 0x00007FFF7FC20000: C:\\Windows\\system32\\wbem\\FastProx (0x10b000 bytes).\n2026-05-28 18:31:59,797 [root] DEBUG: 5020: DLL loaded at 0x00007FFF7FBA0000: C:\\Windows\\system32\\wbem\\esscli (0x7d000 bytes).\n2026-05-28 18:31:59,797 [root] DEBUG: 5020: DLL loaded at 0x00007FFF56920000: C:\\Windows\\system32\\wbem\\wbemcore (0x1e9000 bytes).\n2026-05-28 18:31:59,816 [root] DEBUG: 5020: DLL loaded at 0x00007FFF82A50000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-05-28 18:31:59,820 [root] DEBUG: 2380: DLL loaded at 0x00007FFF82A50000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-05-28 18:31:59,833 [root] DEBUG: 5020: DLL loaded at 0x00007FFF95060000: C:\\Windows\\system32\\authZ (0x4f000 bytes).\n2026-05-28 18:31:59,842 [root] DEBUG: 5020: DLL loaded at 0x00007FFF8BE60000: C:\\Windows\\system32\\wbem\\wmiutils (0x28000 bytes).\n2026-05-28 18:31:59,843 [root] DEBUG: 7284: DLL loaded at 0x00007FFF93E40000: C:\\Windows\\SYSTEM32\\dwmapi (0x2f000 bytes).\n2026-05-28 18:31:59,849 [root] DEBUG: 5020: DLL loaded at 0x00007FFF7FAB0000: C:\\Windows\\system32\\wbem\\repdrvfs (0x71000 bytes).\n2026-05-28 18:31:59,854 [root] DEBUG: 5020: DLL loaded at 0x00007FFF905B0000: C:\\Windows\\system32\\Wevtapi (0x65000 bytes).\n2026-05-28 18:31:59,867 [root] DEBUG: 7284: DLL loaded at 0x00007FFF84F00000: C:\\Windows\\System32\\Windows.Security.Authentication.Web.Core (0x11d000 bytes).\n2026-05-28 18:31:59,884 [root] DEBUG: 7284: DLL loaded at 0x00007FFF7D100000: C:\\Users\\admin\\AppData\\Local\\Microsoft\\Edge\\User Data\\Well Known Domains\\1.2.0.0\\well_known_domains (0x9e000 bytes).\n2026-05-28 18:31:59,897 [root] DEBUG: 7284: DLL loaded at 0x00007FFF874D0000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 18:31:59,898 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95E30000: C:\\Windows\\SYSTEM32\\MSASN1 (0x12000 bytes).\n2026-05-28 18:31:59,900 [root] DEBUG: 7284: DLL loaded at 0x00007FFF78140000: C:\\Windows\\System32\\vaultcli (0x51000 bytes).\n2026-05-28 18:31:59,902 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95BF0000: C:\\Windows\\SYSTEM32\\CRYPTSP (0x18000 bytes).\n2026-05-28 18:31:59,915 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95330000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-28 18:31:59,954 [root] DEBUG: 7284: DLL loaded at 0x00007FFF59130000: C:\\Windows\\System32\\MicrosoftAccountWAMExtension (0x8c000 bytes).\n2026-05-28 18:31:59,990 [root] DEBUG: 5020: DLL loaded at 0x00007FFF973C0000: C:\\Windows\\System32\\coml2 (0x79000 bytes).\n2026-05-28 18:32:00,005 [root] DEBUG: 5020: DLL loaded at 0x00007FFF7D520000: C:\\Windows\\SYSTEM32\\amsi (0x1f000 bytes).\n2026-05-28 18:32:00,006 [root] DEBUG: 5020: DLL loaded at 0x00007FFF96220000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 18:32:00,007 [root] DEBUG: 5020: DLL loaded at 0x00007FFF96260000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 18:32:00,008 [root] DEBUG: 5020: DLL loaded at 0x00007FFF7D4D0000: C:\\Program Files\\Windows Defender\\MpOav (0x44000 bytes).\n2026-05-28 18:32:00,009 [root] DEBUG: 5020: DLL loaded at 0x00007FFF853A0000: C:\\Windows\\system32\\version (0xa000 bytes).\n2026-05-28 18:32:00,018 [root] DEBUG: 5020: DLL loaded at 0x00007FFF8BF60000: C:\\Windows\\SYSTEM32\\NCObjAPI (0x18000 bytes).\n2026-05-28 18:32:00,019 [root] DEBUG: 5020: DLL loaded at 0x00007FFF3A940000: C:\\Windows\\system32\\wbem\\wmiprvsd (0xd7000 bytes).\n2026-05-28 18:32:00,022 [root] DEBUG: 5020: DLL loaded at 0x00007FFF590A0000: C:\\Windows\\system32\\wbem\\wbemess (0x83000 bytes).\n2026-05-28 18:32:00,024 [root] DEBUG: 5020: DLL loaded at 0x00007FFF95BF0000: C:\\Windows\\SYSTEM32\\cryptsp (0x18000 bytes).\n2026-05-28 18:32:00,025 [root] DEBUG: 5020: DLL loaded at 0x00007FFF95330000: C:\\Windows\\system32\\rsaenh (0x34000 bytes).\n2026-05-28 18:32:00,041 [root] DEBUG: 2380: DLL loaded at 0x00007FFF7FC20000: C:\\Windows\\system32\\wbem\\fastprox (0x10b000 bytes).\n2026-05-28 18:32:00,043 [root] DEBUG: 2380: DLL loaded at 0x00007FFF7D520000: C:\\Windows\\SYSTEM32\\amsi (0x1f000 bytes).\n2026-05-28 18:32:00,044 [root] DEBUG: 2380: DLL loaded at 0x00007FFF96220000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 18:32:00,050 [root] DEBUG: 2380: DLL loaded at 0x00007FFF96260000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 18:32:00,051 [root] DEBUG: 2380: DLL loaded at 0x00007FFF7D4D0000: C:\\Program Files\\Windows Defender\\MpOav (0x44000 bytes).\n2026-05-28 18:32:00,053 [root] DEBUG: 2380: DLL loaded at 0x00007FFF853A0000: C:\\Windows\\system32\\version (0xa000 bytes).\n2026-05-28 18:32:00,055 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_ExecQuery\n2026-05-28 18:32:00,055 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_ExecQueryAsync\n2026-05-28 18:32:00,056 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_CreateInstanceEnum\n2026-05-28 18:32:00,056 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_CreateInstanceEnumAsync\n2026-05-28 18:32:00,057 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_GetObjectW\n2026-05-28 18:32:00,058 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_GetObjectAsync\n2026-05-28 18:32:00,058 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_ExecMethod\n2026-05-28 18:32:00,060 [root] DEBUG: 2380: Successfully installed hook on COM Object function IWbemServices_ExecMethodAsync\n2026-05-28 18:32:00,082 [root] DEBUG: 840: CreateProcessHandler: Injection info set for new process 9420: C:\\Windows\\system32\\wbem\\wmiprvse.exe, ImageBase: 0x00007FF7C5600000\n2026-05-28 18:32:00,082 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 9420\n2026-05-28 18:32:00,083 [lib.api.process] INFO: Monitor config for process 9420: C:\\2unxg6vp\\dll\\9420.ini\n2026-05-28 18:32:00,083 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:00,519 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:00,523 [root] DEBUG: Loader: Injecting process 9420 (thread 1716) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,523 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:00,524 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,525 [lib.api.process] INFO: Injected into 64-bit <Process 9420 WmiPrvSE.exe>\n2026-05-28 18:32:00,526 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 9420\n2026-05-28 18:32:00,526 [lib.api.process] INFO: Monitor config for process 9420: C:\\2unxg6vp\\dll\\9420.ini\n2026-05-28 18:32:00,526 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:00,601 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:00,606 [root] DEBUG: Loader: Injecting process 9420 (thread 1716) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,607 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 18:32:00,608 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,610 [lib.api.process] INFO: Injected into 64-bit <Process 9420 WmiPrvSE.exe>\n2026-05-28 18:32:00,622 [root] DEBUG: 9420: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:32:00,623 [root] DEBUG: 9420: Interactive desktop enabled.\n2026-05-28 18:32:00,624 [root] DEBUG: 9420: Dropped file limit defaulting to 100.\n2026-05-28 18:32:00,626 [root] DEBUG: 9420: Disabling sleep skipping.\n2026-05-28 18:32:00,626 [root] DEBUG: 9420: Services hook set enabled\n2026-05-28 18:32:00,628 [root] DEBUG: 9420: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:32:00,639 [root] DEBUG: 9420: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:32:00,640 [root] DEBUG: 9420: Monitor initialised: 64-bit capemon loaded in process 9420 at 0x00007FFF52E70000, thread 1716, image base 0x00007FF7C5600000, stack from 0x00000002AB940000-0x00000002AB950000\n2026-05-28 18:32:00,640 [root] DEBUG: 9420: Commandline: C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding\n2026-05-28 18:32:00,654 [root] DEBUG: 9420: Hooked 69 out of 69 functions\n2026-05-28 18:32:00,659 [root] DEBUG: 9420: RestoreHeaders: Restored original import table.\n2026-05-28 18:32:00,660 [root] INFO: Loaded monitor into process with pid 9420\n2026-05-28 18:32:00,662 [root] DEBUG: 9420: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:32:00,663 [root] DEBUG: 9420: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 18:32:00,665 [root] DEBUG: 9420: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:32:00,667 [root] DEBUG: 9420: DLL loaded at 0x00007FFF82DC0000: C:\\Windows\\system32\\wbem\\wbemprox (0x11000 bytes).\n2026-05-28 18:32:00,672 [root] DEBUG: 9420: DLL loaded at 0x00007FFF82A50000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-05-28 18:32:00,682 [root] DEBUG: 9420: DLL loaded at 0x00007FFF8BE60000: C:\\Windows\\system32\\wbem\\wmiutils (0x28000 bytes).\n2026-05-28 18:32:00,697 [root] DEBUG: 9420: DLL loaded at 0x00007FFF96190000: C:\\Windows\\SYSTEM32\\powrprof (0x4b000 bytes).\n2026-05-28 18:32:00,698 [root] DEBUG: 9420: DLL loaded at 0x00007FFF3A6D0000: C:\\Windows\\SYSTEM32\\framedynos (0x52000 bytes).\n2026-05-28 18:32:00,698 [root] DEBUG: 9420: DLL loaded at 0x00007FFF3A730000: C:\\Windows\\system32\\wbem\\cimwin32 (0x20c000 bytes).\n2026-05-28 18:32:00,699 [root] DEBUG: 9420: DLL loaded at 0x00007FFF96170000: C:\\Windows\\SYSTEM32\\UMPDC (0x12000 bytes).\n2026-05-28 18:32:00,711 [root] DEBUG: 9420: DLL loaded at 0x00007FFF91070000: C:\\Windows\\SYSTEM32\\winbrand (0x35000 bytes).\n2026-05-28 18:32:00,714 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95CA0000: C:\\Windows\\SYSTEM32\\wldp (0x2d000 bytes).\n2026-05-28 18:32:00,716 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95CA0000: C:\\Windows\\SYSTEM32\\wldp (0x2d000 bytes).\n2026-05-28 18:32:00,718 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95CA0000: C:\\Windows\\SYSTEM32\\wldp (0x2d000 bytes).\n2026-05-28 18:32:00,720 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95CA0000: C:\\Windows\\SYSTEM32\\wldp (0x2d000 bytes).\n2026-05-28 18:32:00,721 [root] DEBUG: 9420: DLL loaded at 0x000001BF1FC80000: C:\\Windows\\SYSTEM32\\SECURITY (0x3000 bytes).\n2026-05-28 18:32:00,722 [root] DEBUG: 9420: DLL loaded at 0x00007FFF87320000: C:\\Windows\\SYSTEM32\\SECUR32 (0xc000 bytes).\n2026-05-28 18:32:00,723 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95240000: C:\\Windows\\system32\\schannel (0x97000 bytes).\n2026-05-28 18:32:00,723 [root] DEBUG: 9420: CreateThreadBreakpoints: Failed to open thread and get a handle.\n2026-05-28 18:32:00,742 [root] DEBUG: 9420: DLL loaded at 0x00007FFF85400000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x19000 bytes).\n2026-05-28 18:32:00,743 [root] DEBUG: 9420: DLL loaded at 0x00007FFF8C070000: C:\\Windows\\SYSTEM32\\SAMCLI (0x19000 bytes).\n2026-05-28 18:32:00,744 [root] DEBUG: 9420: DLL loaded at 0x00007FFF8CEC0000: C:\\Windows\\SYSTEM32\\SRVCLI (0x28000 bytes).\n2026-05-28 18:32:00,745 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95850000: C:\\Windows\\SYSTEM32\\NETUTILS (0xc000 bytes).\n2026-05-28 18:32:00,746 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95800000: C:\\Windows\\SYSTEM32\\LOGONCLI (0x43000 bytes).\n2026-05-28 18:32:00,746 [root] DEBUG: 9420: DLL loaded at 0x00007FFF8BE20000: C:\\Windows\\SYSTEM32\\SCHEDCLI (0xc000 bytes).\n2026-05-28 18:32:00,747 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95490000: C:\\Windows\\SYSTEM32\\WKSCLI (0x19000 bytes).\n2026-05-28 18:32:00,748 [root] DEBUG: 9420: DLL loaded at 0x00007FFF917A0000: C:\\Windows\\SYSTEM32\\DSROLE (0xa000 bytes).\n2026-05-28 18:32:00,750 [root] DEBUG: 9420: DLL loaded at 0x00007FFF82EB0000: C:\\Windows\\SYSTEM32\\cscapi (0x12000 bytes).\n2026-05-28 18:32:00,789 [root] DEBUG: 9420: DLL loaded at 0x00007FFF91FE0000: C:\\Windows\\SYSTEM32\\wtsapi32 (0x14000 bytes).\n2026-05-28 18:32:00,790 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95FF0000: C:\\Windows\\SYSTEM32\\WINSTA (0x5b000 bytes).\n2026-05-28 18:32:00,792 [root] DEBUG: 9420: DLL loaded at 0x00007FFF96AF0000: C:\\Windows\\System32\\cfgmgr32 (0x4e000 bytes).\n2026-05-28 18:32:00,794 [root] DEBUG: 9420: DLL loaded at 0x00007FFF96050000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 18:32:00,798 [root] DEBUG: 9420: DLL loaded at 0x000001BF1FCC0000: C:\\Windows\\SYSTEM32\\WMI (0x3000 bytes).\n2026-05-28 18:32:00,799 [root] DEBUG: 9420: DLL loaded at 0x00007FFF90640000: C:\\Windows\\SYSTEM32\\wmiclnt (0x11000 bytes).\n2026-05-28 18:32:00,813 [root] DEBUG: 840: CreateProcessHandler: Injection info set for new process 10576: C:\\Windows\\system32\\wbem\\wmiprvse.exe, ImageBase: 0x00007FF7C5600000\n2026-05-28 18:32:00,814 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 10576\n2026-05-28 18:32:00,814 [lib.api.process] INFO: Monitor config for process 10576: C:\\2unxg6vp\\dll\\10576.ini\n2026-05-28 18:32:00,814 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:00,888 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:00,893 [root] DEBUG: Loader: Injecting process 10576 (thread 10580) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,894 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:00,894 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,895 [lib.api.process] INFO: Injected into 64-bit <Process 10576 WmiPrvSE.exe>\n2026-05-28 18:32:00,896 [root] INFO: Announced 64-bit process name: WmiPrvSE.exe pid: 10576\n2026-05-28 18:32:00,896 [lib.api.process] INFO: Monitor config for process 10576: C:\\2unxg6vp\\dll\\10576.ini\n2026-05-28 18:32:00,897 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:00,973 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:00,978 [root] DEBUG: Loader: Injecting process 10576 (thread 10580) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,979 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 18:32:00,979 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:00,980 [lib.api.process] INFO: Injected into 64-bit <Process 10576 WmiPrvSE.exe>\n2026-05-28 18:32:00,985 [root] DEBUG: 10576: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:32:00,986 [root] DEBUG: 10576: Interactive desktop enabled.\n2026-05-28 18:32:00,986 [root] DEBUG: 10576: Dropped file limit defaulting to 100.\n2026-05-28 18:32:00,988 [root] DEBUG: 10576: Disabling sleep skipping.\n2026-05-28 18:32:00,989 [root] DEBUG: 10576: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:32:01,001 [root] DEBUG: 10576: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:32:01,002 [root] DEBUG: 10576: YaraScan: Scanning 0x00007FF7C5600000, size 0x7dcfe\n2026-05-28 18:32:01,005 [root] DEBUG: 10576: Monitor initialised: 64-bit capemon loaded in process 10576 at 0x00007FFF52E70000, thread 10580, image base 0x00007FF7C5600000, stack from 0x000000D783BE0000-0x000000D783BF0000\n2026-05-28 18:32:01,006 [root] DEBUG: 10576: Commandline: C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding\n2026-05-28 18:32:01,017 [root] DEBUG: 10576: hook_api: LdrpCallInitRoutine export address 0x00007FFF98C699BC obtained via GetFunctionAddress\n2026-05-28 18:32:01,040 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 18:32:01,040 [root] DEBUG: 10576: set_hooks: Unable to hook LockResource\n2026-05-28 18:32:01,044 [root] DEBUG: 10576: Hooked 627 out of 628 functions\n2026-05-28 18:32:01,047 [root] DEBUG: 10576: Syscall hook installed, syscall logging level 1\n2026-05-28 18:32:01,053 [root] DEBUG: 10576: RestoreHeaders: Restored original import table.\n2026-05-28 18:32:01,053 [root] INFO: Loaded monitor into process with pid 10576\n2026-05-28 18:32:01,054 [root] DEBUG: 10576: caller_dispatch: Added region at 0x00007FF7C5600000 to tracked regions list (kernel32::SetUnhandledExceptionFilter returns to 0x00007FF7C5612CD1, thread 10580).\n2026-05-28 18:32:01,054 [root] DEBUG: 10576: YaraScan: Scanning 0x00007FF7C5600000, size 0x7dcfe\n2026-05-28 18:32:01,058 [root] DEBUG: 10576: ProcessImageBase: Main module image at 0x00007FF7C5600000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:32:01,063 [root] DEBUG: 10576: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:32:01,064 [root] DEBUG: 10576: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 18:32:01,068 [root] DEBUG: 10576: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:32:01,071 [root] DEBUG: 10576: DLL loaded at 0x00007FFF82DC0000: C:\\Windows\\system32\\wbem\\wbemprox (0x11000 bytes).\n2026-05-28 18:32:01,078 [root] DEBUG: 10576: DLL loaded at 0x00007FFF82A50000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-05-28 18:32:01,103 [root] DEBUG: 10576: DLL loaded at 0x00007FFF8BE60000: C:\\Windows\\system32\\wbem\\wmiutils (0x28000 bytes).\n2026-05-28 18:32:01,124 [root] DEBUG: 10576: DLL loaded at 0x00007FFF7F2F0000: C:\\Windows\\SYSTEM32\\pdh (0x49000 bytes).\n2026-05-28 18:32:01,125 [root] DEBUG: 10576: DLL loaded at 0x00007FFF905B0000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-28 18:32:01,126 [root] DEBUG: 10576: DLL loaded at 0x00007FFF82E80000: C:\\Windows\\System32\\wbem\\WmiPerfClass (0x27000 bytes).\n2026-05-28 18:32:01,172 [root] DEBUG: 2380: DLL loaded at 0x00007FFF8D860000: C:\\Windows\\system32\\fveapi (0xf5000 bytes).\n2026-05-28 18:32:01,177 [root] DEBUG: 2380: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:32:01,178 [root] DEBUG: 2380: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\system32\\tbs (0x1b000 bytes).\n2026-05-28 18:32:01,210 [root] DEBUG: 9420: DLL loaded at 0x00007FFF3A670000: C:\\Windows\\SYSTEM32\\PROVTHRD (0x52000 bytes).\n2026-05-28 18:32:01,210 [root] DEBUG: 9420: DLL loaded at 0x00007FFF95450000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 18:32:01,211 [root] DEBUG: 9420: DLL loaded at 0x00007FFF905B0000: C:\\Windows\\SYSTEM32\\wevtapi (0x65000 bytes).\n2026-05-28 18:32:01,211 [root] DEBUG: 9420: DLL loaded at 0x00007FFF7D0B0000: C:\\Windows\\system32\\wbem\\ntevt (0x43000 bytes).\n2026-05-28 18:32:01,231 [root] DEBUG: 9420: DLL loaded at 0x000001BF1FCE0000: C:\\Windows\\SYSTEM32\\tzres (0x3000 bytes).\n2026-05-28 18:32:01,234 [root] DEBUG: 2380: DLL loaded at 0x00007FFF91EB0000: C:\\Windows\\system32\\PROPSYS (0xf6000 bytes).\n2026-05-28 18:32:01,264 [root] DEBUG: 9420: DLL loaded at 0x00007FFF8BE10000: C:\\Windows\\System32\\Win32_DeviceGuard (0xc000 bytes).\n2026-05-28 18:32:01,267 [root] DEBUG: 9420: DLL loaded at 0x00007FFF8BDB0000: C:\\Windows\\SYSTEM32\\miutils (0x60000 bytes).\n2026-05-28 18:32:01,267 [root] DEBUG: 9420: DLL loaded at 0x00007FFF8BE30000: C:\\Windows\\SYSTEM32\\mi (0x23000 bytes).\n2026-05-28 18:32:01,268 [root] DEBUG: 9420: DLL loaded at 0x00007FFF59060000: C:\\Windows\\system32\\wmitomi (0x3a000 bytes).\n2026-05-28 18:32:01,274 [root] DEBUG: 9420: Successfully installed hook on COM Object function WbemLocator_ConnectServer\n2026-05-28 18:32:01,280 [root] DEBUG: 2380: DLL loaded at 0x00007FFF8D860000: C:\\Windows\\SYSTEM32\\fveapi (0xf5000 bytes).\n2026-05-28 18:32:01,309 [root] DEBUG: 2380: DLL loaded at 0x00007FFF96050000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 18:32:01,354 [root] DEBUG: 7284: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\SYSTEM32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:32:01,355 [root] DEBUG: 7284: DLL loaded at 0x00007FFF90020000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 18:32:01,377 [root] DEBUG: 2380: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:32:01,378 [root] DEBUG: 2380: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 18:32:01,380 [root] DEBUG: 2380: DLL loaded at 0x00007FFF7FB70000: C:\\Windows\\SYSTEM32\\reinfo (0x30000 bytes).\n2026-05-28 18:32:01,384 [root] DEBUG: 8372: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:32:01,387 [root] DEBUG: 8372: DLL loaded at 0x00007FFF8CFE0000: C:\\Windows\\SYSTEM32\\wbemcomn (0x90000 bytes).\n2026-05-28 18:32:01,388 [root] DEBUG: 8372: DLL loaded at 0x00007FFF82DC0000: C:\\Windows\\system32\\wbem\\wbemprox (0x11000 bytes).\n2026-05-28 18:32:01,389 [root] DEBUG: 8372: Successfully installed hook on COM Object function WbemLocator_ConnectServer\n2026-05-28 18:32:01,396 [root] DEBUG: 8372: DLL loaded at 0x00007FFF82A50000: C:\\Windows\\system32\\wbem\\wbemsvc (0x14000 bytes).\n2026-05-28 18:32:01,400 [root] DEBUG: 8372: DLL loaded at 0x00007FFF7FC20000: C:\\Windows\\system32\\wbem\\fastprox (0x10b000 bytes).\n2026-05-28 18:32:01,403 [root] DEBUG: 8372: DLL loaded at 0x00007FFF7D520000: C:\\Windows\\SYSTEM32\\amsi (0x1f000 bytes).\n2026-05-28 18:32:01,404 [root] DEBUG: 8372: DLL loaded at 0x00007FFF96220000: C:\\Windows\\SYSTEM32\\USERENV (0x2e000 bytes).\n2026-05-28 18:32:01,405 [root] DEBUG: 8372: DLL loaded at 0x00007FFF96260000: C:\\Windows\\SYSTEM32\\profapi (0x25000 bytes).\n2026-05-28 18:32:01,407 [root] DEBUG: 8372: DLL loaded at 0x00007FFF7D4D0000: C:\\Program Files\\Windows Defender\\MpOav (0x44000 bytes).\n2026-05-28 18:32:01,410 [root] DEBUG: 8372: DLL loaded at 0x00007FFF853A0000: C:\\Windows\\system32\\version (0xa000 bytes).\n2026-05-28 18:32:01,413 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_ExecQuery\n2026-05-28 18:32:01,414 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_ExecQueryAsync\n2026-05-28 18:32:01,414 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_CreateInstanceEnum\n2026-05-28 18:32:01,415 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_CreateInstanceEnumAsync\n2026-05-28 18:32:01,415 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_GetObjectW\n2026-05-28 18:32:01,416 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_GetObjectAsync\n2026-05-28 18:32:01,416 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_ExecMethod\n2026-05-28 18:32:01,416 [root] DEBUG: 8372: Successfully installed hook on COM Object function IWbemServices_ExecMethodAsync\n2026-05-28 18:32:01,458 [root] DEBUG: 8372: DLL loaded at 0x00007FFF8D860000: C:\\Windows\\system32\\fveapi (0xf5000 bytes).\n2026-05-28 18:32:01,461 [root] DEBUG: 8372: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:32:01,462 [root] DEBUG: 8372: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\system32\\tbs (0x1b000 bytes).\n2026-05-28 18:32:01,475 [root] DEBUG: 9420: DLL loaded at 0x000001BF1FCE0000: C:\\Windows\\SYSTEM32\\tzres (0x3000 bytes).\n2026-05-28 18:32:01,477 [root] DEBUG: 8372: DLL loaded at 0x00007FFF91EB0000: C:\\Windows\\system32\\PROPSYS (0xf6000 bytes).\n2026-05-28 18:32:01,493 [root] DEBUG: 8372: DLL loaded at 0x00007FFF8D860000: C:\\Windows\\SYSTEM32\\fveapi (0xf5000 bytes).\n2026-05-28 18:32:01,522 [root] DEBUG: 8372: DLL loaded at 0x00007FFF96050000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 18:32:01,583 [root] DEBUG: 8372: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:32:01,584 [root] DEBUG: 8372: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 18:32:01,586 [root] DEBUG: 8372: DLL loaded at 0x00007FFF7FB70000: C:\\Windows\\SYSTEM32\\reinfo (0x30000 bytes).\n2026-05-28 18:32:02,579 [root] DEBUG: 7284: DLL loaded at 0x00007FFF960C0000: C:\\Windows\\SYSTEM32\\sxs (0xa2000 bytes).\n2026-05-28 18:32:02,585 [root] DEBUG: 7284: DLL loaded at 0x00007FFF916B0000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 18:32:02,586 [root] DEBUG: 7284: DLL loaded at 0x00007FFF7DDC0000: C:\\Windows\\System32\\Windows.Internal.UI.Shell.WindowTabManager (0x6d000 bytes).\n2026-05-28 18:32:03,296 [root] DEBUG: 2380: NtTerminateProcess hook: Attempting to dump process 2380\n2026-05-28 18:32:03,297 [root] DEBUG: 2380: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 18:32:03,319 [root] INFO: Process with pid 2380 has terminated\n2026-05-28 18:32:03,825 [root] DEBUG: 7284: DLL loaded at 0x00007FFF7CEE0000: C:\\Windows\\System32\\ShellCommonCommonProxyStub (0xe4000 bytes).\n2026-05-28 18:32:06,343 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 11572: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:32:06,344 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 11572\n2026-05-28 18:32:06,345 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 11572\n2026-05-28 18:32:07,492 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 11652: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:32:07,493 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 11652\n2026-05-28 18:32:07,495 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 11652\n2026-05-28 18:32:07,522 [root] DEBUG: 7284: DLL loaded at 0x00007FFF3A280000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\telclient (0x3ed000 bytes).\n2026-05-28 18:32:07,551 [root] DEBUG: 7284: DLL loaded at 0x00007FFF39C20000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\oneds (0x33f000 bytes).\n2026-05-28 18:32:07,558 [root] DEBUG: 7284: DLL loaded at 0x00007FFF91760000: C:\\Windows\\System32\\netprofm (0x3f000 bytes).\n2026-05-28 18:32:07,559 [root] DEBUG: 7284: DLL loaded at 0x00007FFF986E0000: C:\\Windows\\System32\\SETUPAPI (0x46e000 bytes).\n2026-05-28 18:32:07,560 [root] DEBUG: 7284: DLL loaded at 0x00007FFF3D070000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\ffmpeg (0x467000 bytes).\n2026-05-28 18:32:07,561 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96050000: C:\\Windows\\SYSTEM32\\DEVOBJ (0x33000 bytes).\n2026-05-28 18:32:07,562 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8E350000: C:\\Windows\\System32\\npmproxy (0x10000 bytes).\n2026-05-28 18:32:07,565 [root] DEBUG: 7284: DLL loaded at 0x00007FFF83180000: C:\\Windows\\system32\\TenantRestrictionsPlugin (0x1b000 bytes).\n2026-05-28 18:32:07,571 [root] DEBUG: 7284: DLL loaded at 0x00007FFF96A80000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-28 18:32:07,572 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94F50000: C:\\Windows\\System32\\FirewallAPI (0x96000 bytes).\n2026-05-28 18:32:07,573 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94F10000: C:\\Windows\\System32\\fwbase (0x36000 bytes).\n2026-05-28 18:32:07,576 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 11752: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF61EFC0000\n2026-05-28 18:32:07,576 [root] DEBUG: 7284: DLL loaded at 0x00007FFF39BA0000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\microsoft_shell_integration (0x78000 bytes).\n2026-05-28 18:32:07,579 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 11752\n2026-05-28 18:32:07,579 [lib.api.process] INFO: Monitor config for process 11752: C:\\2unxg6vp\\dll\\11752.ini\n2026-05-28 18:32:07,581 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:07,582 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94110000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 18:32:07,583 [root] DEBUG: 7284: DLL loaded at 0x00007FFF91E70000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 18:32:07,583 [root] DEBUG: 7284: DLL loaded at 0x00007FFF82770000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 18:32:07,703 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 18:32:07,703 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 18:32:07,713 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:07,717 [root] DEBUG: Loader: Injecting process 11752 (thread 11756) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:07,718 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:07,719 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:07,721 [lib.api.process] INFO: Injected into 64-bit <Process 11752 identity_helper.exe>\n2026-05-28 18:32:07,737 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8E6A0000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-28 18:32:07,743 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8B370000: C:\\Windows\\SYSTEM32\\windows.staterepositorycore (0x11000 bytes).\n2026-05-28 18:32:07,745 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 11832: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe, ImageBase: 0x00007FF61EFC0000\n2026-05-28 18:32:07,746 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 11832\n2026-05-28 18:32:07,746 [lib.api.process] INFO: Monitor config for process 11832: C:\\2unxg6vp\\dll\\11832.ini\n2026-05-28 18:32:07,751 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:07,840 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 18:32:07,840 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 18:32:07,843 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:07,847 [root] DEBUG: Loader: Injecting process 11832 (thread 11836) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:07,848 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:07,848 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:07,849 [lib.api.process] INFO: Injected into 64-bit <Process 11832 identity_helper.exe>\n2026-05-28 18:32:07,859 [root] INFO: Announced 64-bit process name: identity_helper.exe pid: 11832\n2026-05-28 18:32:07,859 [lib.api.process] INFO: Monitor config for process 11832: C:\\2unxg6vp\\dll\\11832.ini\n2026-05-28 18:32:07,871 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:07,963 [lib.api.process] INFO: Potential dll side-loading detected in local directory: d3dcompiler_47.dll\n2026-05-28 18:32:07,963 [lib.api.process] INFO: Potential dll side-loading detected in local directory: onnxruntime.dll\n2026-05-28 18:32:07,965 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:07,970 [root] DEBUG: Loader: Injecting process 11832 (thread 11836) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:07,970 [root] DEBUG: InjectDllViaIAT: This image has already been patched.\n2026-05-28 18:32:07,970 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:07,972 [lib.api.process] INFO: Injected into 64-bit <Process 11832 identity_helper.exe>\n2026-05-28 18:32:07,992 [root] DEBUG: 11832: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:32:07,994 [root] DEBUG: 11832: Interactive desktop enabled.\n2026-05-28 18:32:07,995 [root] DEBUG: 11832: Dropped file limit defaulting to 100.\n2026-05-28 18:32:08,002 [root] DEBUG: 11832: Disabling sleep skipping.\n2026-05-28 18:32:08,003 [root] DEBUG: 11832: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:32:08,009 [root] DEBUG: 7284: DLL loaded at 0x00007FFF85060000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-28 18:32:08,011 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8ED20000: C:\\Windows\\System32\\AppXDeploymentClient (0x102000 bytes).\n2026-05-28 18:32:08,012 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8E370000: C:\\Windows\\system32\\wlanapi (0x74000 bytes).\n2026-05-28 18:32:08,015 [root] DEBUG: 11832: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:32:08,016 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,042 [root] DEBUG: 11832: Monitor initialised: 64-bit capemon loaded in process 11832 at 0x00007FFF52E70000, thread 11836, image base 0x00007FF61EFC0000, stack from 0x000000AE0A954000-0x000000AE0A960000\n2026-05-28 18:32:08,043 [root] DEBUG: 11832: Commandline: \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\identity_helper.exe\" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=windows_package_identity --skip-read-main-dll --metrics-shmem-handle=5952,i,11470755141613762127,4055455473900018829,524288 --field-trial-handle=2264,i,16983387269976259416,4354945647829116387,262144 --variations-seed-version --pseudonymization-salt-handle=2320,i,3707866102701366264,3666518045583744\n2026-05-28 18:32:08,044 [root] DEBUG: 11832: add_all_dlls_to_dll_ranges: skipping C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll\n2026-05-28 18:32:08,057 [root] DEBUG: 11832: hook_api: LdrpCallInitRoutine export address 0x00007FFF98C699BC obtained via GetFunctionAddress\n2026-05-28 18:32:08,077 [root] DEBUG: 7284: DLL loaded at 0x00007FFF85400000: C:\\Windows\\SYSTEM32\\NETAPI32 (0x19000 bytes).\n2026-05-28 18:32:08,080 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 18:32:08,080 [root] DEBUG: 11832: set_hooks: Unable to hook LockResource\n2026-05-28 18:32:08,085 [root] DEBUG: 11832: Hooked 627 out of 628 functions\n2026-05-28 18:32:08,094 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95D10000: C:\\Windows\\SYSTEM32\\ncrypt (0x27000 bytes).\n2026-05-28 18:32:08,095 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95CD0000: C:\\Windows\\SYSTEM32\\NTASN1 (0x3b000 bytes).\n2026-05-28 18:32:08,095 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8E580000: C:\\Windows\\system32\\PCPKsp (0x118000 bytes).\n2026-05-28 18:32:08,096 [root] DEBUG: 7284: DLL loaded at 0x00007FFF98560000: C:\\Windows\\System32\\imagehlp (0x1d000 bytes).\n2026-05-28 18:32:08,097 [root] DEBUG: 7284: DLL loaded at 0x00007FFF8E460000: C:\\Windows\\SYSTEM32\\tbs (0x1b000 bytes).\n2026-05-28 18:32:08,098 [root] DEBUG: 7284: DLL loaded at 0x00007FFF834F0000: C:\\Windows\\system32\\ncryptprov (0x5a000 bytes).\n2026-05-28 18:32:08,100 [root] DEBUG: 11832: Syscall hook installed, syscall logging level 1\n2026-05-28 18:32:08,105 [root] DEBUG: 11832: RestoreHeaders: Restored original import table.\n2026-05-28 18:32:08,107 [root] INFO: Loaded monitor into process with pid 11832\n2026-05-28 18:32:08,108 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n2026-05-28 18:32:08,170 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n2026-05-28 18:32:08,195 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n2026-05-28 18:32:08,218 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n2026-05-28 18:32:08,248 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n2026-05-28 18:32:08,273 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n2026-05-28 18:32:08,289 [root] DEBUG: 7284: DLL loaded at 0x00007FFF95A00000: C:\\Windows\\system32\\mswsock (0x6a000 bytes).\n2026-05-28 18:32:08,299 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FFF52500000, size 0x4b9994\n2026-05-28 18:32:08,327 [root] DEBUG: 11832: caller_dispatch: Added region at 0x00007FFF52500000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FFF526FF156, thread 11836).\n2026-05-28 18:32:08,328 [root] DEBUG: 11832: caller_dispatch: Scanning calling region at 0x00007FFF52500000...\n2026-05-28 18:32:08,338 [root] DEBUG: 11832: ProcessTrackedRegion: Region at 0x00007FFF52500000 mapped as \\Device\\HarddiskVolume2\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge_elf.dll appears unmodified, skipping\n2026-05-28 18:32:08,340 [root] DEBUG: 11832: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptprimitives (0x82000 bytes).\n2026-05-28 18:32:08,362 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,382 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,398 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,415 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,431 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,446 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,463 [root] DEBUG: 11832: caller_dispatch: Added region at 0x00007FF61EFC0000 to tracked regions list (ntdll::NtProtectVirtualMemory returns to 0x00007FF61F0B4096, thread 11836).\n2026-05-28 18:32:08,464 [root] DEBUG: 11832: YaraScan: Scanning 0x00007FF61EFC0000, size 0x28b4d8\n2026-05-28 18:32:08,480 [root] DEBUG: 11832: ProcessImageBase: Main module image at 0x00007FF61EFC0000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:32:08,484 [root] DEBUG: 11832: DLL loaded at 0x00007FFF984B0000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 18:32:08,512 [root] DEBUG: 11832: DLL loaded at 0x0000024AC5000000: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\148.0.3967.83\\msedge (0x136be000 bytes).\n2026-05-28 18:32:08,516 [root] DEBUG: 11832: DLL loaded at 0x00007FFF93CF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 18:32:08,518 [root] DEBUG: 11832: DLL loaded at 0x00007FFF97F00000: C:\\Windows\\System32\\MSCTF (0x114000 bytes).\n2026-05-28 18:32:08,552 [root] DEBUG: 11832: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:32:08,557 [root] DEBUG: 11832: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:32:08,561 [root] DEBUG: 11832: DLL loaded at 0x00007FFF984B0000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 18:32:08,561 [root] DEBUG: 11832: DLL loaded at 0x00007FFF91EB0000: C:\\Windows\\System32\\PROPSYS (0xf6000 bytes).\n2026-05-28 18:32:08,562 [root] DEBUG: 11832: DLL loaded at 0x00007FFF93840000: C:\\Windows\\System32\\CoreMessaging (0xf2000 bytes).\n2026-05-28 18:32:08,565 [root] DEBUG: 11832: DLL loaded at 0x00007FFF84D00000: C:\\Windows\\System32\\execmodelclient (0x63000 bytes).\n2026-05-28 18:32:08,573 [root] DEBUG: 11832: DLL loaded at 0x00007FFF92180000: C:\\Windows\\SYSTEM32\\wintypes (0x155000 bytes).\n2026-05-28 18:32:08,573 [root] DEBUG: 11832: DLL loaded at 0x00007FFF94110000: C:\\Windows\\System32\\RMCLIENT (0x2a000 bytes).\n2026-05-28 18:32:08,574 [root] DEBUG: 11832: DLL loaded at 0x00007FFF91E70000: C:\\Windows\\System32\\XmlLite (0x36000 bytes).\n2026-05-28 18:32:08,574 [root] DEBUG: 11832: DLL loaded at 0x00007FFF90DA0000: C:\\Windows\\System32\\twinapi.appcore (0x203000 bytes).\n2026-05-28 18:32:08,575 [root] DEBUG: 11832: DLL loaded at 0x00007FFF82770000: C:\\Windows\\System32\\wpnapps (0x15b000 bytes).\n2026-05-28 18:32:08,586 [root] DEBUG: 11832: DLL loaded at 0x00007FFF874D0000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 18:32:08,592 [root] DEBUG: 11832: DLL loaded at 0x00007FFF833F0000: C:\\Windows\\system32\\execmodelproxy (0x18000 bytes).\n2026-05-28 18:32:08,597 [root] DEBUG: 11832: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\System32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:32:08,598 [root] DEBUG: 11832: DLL loaded at 0x00007FFF90020000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 18:32:08,600 [root] DEBUG: 11832: DLL loaded at 0x00007FFF916B0000: C:\\Windows\\SYSTEM32\\usermgrcli (0x16000 bytes).\n2026-05-28 18:32:08,609 [root] DEBUG: 11832: DLL loaded at 0x00007FFF8F850000: C:\\Windows\\System32\\OneCoreUAPCommonProxyStub (0x7d0000 bytes).\n2026-05-28 18:32:08,610 [root] DEBUG: 11832: DLL loaded at 0x00007FFF8B820000: C:\\Windows\\System32\\Windows.StateRepositoryPS (0x146000 bytes).\n2026-05-28 18:32:08,617 [root] DEBUG: 11832: DLL loaded at 0x00007FFF96A80000: C:\\Windows\\System32\\WINTRUST (0x67000 bytes).\n2026-05-28 18:32:08,618 [root] DEBUG: 11832: DLL loaded at 0x00007FFF8E6A0000: C:\\Windows\\SYSTEM32\\capauthz (0x51000 bytes).\n2026-05-28 18:32:08,620 [root] DEBUG: 11832: DLL loaded at 0x00007FFF95E30000: C:\\Windows\\System32\\MSASN1 (0x12000 bytes).\n2026-05-28 18:32:08,630 [root] DEBUG: 11832: DLL loaded at 0x00007FFF7D640000: C:\\Windows\\System32\\biwinrt (0x53000 bytes).\n2026-05-28 18:32:08,647 [root] DEBUG: 11832: DLL loaded at 0x00007FFF85060000: C:\\Windows\\System32\\Windows.ApplicationModel (0xe9000 bytes).\n2026-05-28 18:32:08,652 [root] DEBUG: 11832: DLL loaded at 0x00007FFF70D80000: C:\\Windows\\System32\\CryptoWinRT (0x61000 bytes).\n2026-05-28 18:32:08,665 [root] DEBUG: 11832: DLL loaded at 0x00007FFF89AB0000: C:\\Windows\\System32\\StateRepository.Core (0xb1000 bytes).\n2026-05-28 18:32:08,665 [root] DEBUG: 11832: DLL loaded at 0x00007FFF89B70000: C:\\Windows\\System32\\Windows.StateRepository (0x58e000 bytes).\n2026-05-28 18:32:08,666 [root] DEBUG: 11832: DLL loaded at 0x00007FFF82980000: C:\\Windows\\System32\\TileDataRepository (0x99000 bytes).\n2026-05-28 18:32:08,673 [root] DEBUG: 11832: DLL loaded at 0x00007FFF8ECC0000: C:\\Windows\\System32\\usermgrproxy (0x54000 bytes).\n2026-05-28 18:32:08,675 [root] DEBUG: 11832: DLL loaded at 0x00007FFF7C440000: C:\\Windows\\System32\\Windows.Storage.ApplicationData (0x66000 bytes).\n2026-05-28 18:32:08,682 [root] DEBUG: 11832: DLL loaded at 0x00007FFF95CA0000: C:\\Windows\\System32\\Wldp (0x2d000 bytes).\n2026-05-28 18:32:08,686 [root] DEBUG: 11832: DLL loaded at 0x00007FFF94410000: C:\\Windows\\SYSTEM32\\windows.storage (0x79b000 bytes).\n2026-05-28 18:32:08,703 [root] DEBUG: 11832: DLL loaded at 0x00007FFF8A550000: C:\\Windows\\system32\\mssprxy (0x28000 bytes).\n2026-05-28 18:32:08,732 [root] DEBUG: 11832: DLL loaded at 0x00007FFF96AF0000: C:\\Windows\\System32\\CFGMGR32 (0x4e000 bytes).\n2026-05-28 18:32:08,769 [root] DEBUG: 11832: DLL loaded at 0x00007FFF94BF0000: C:\\Windows\\System32\\dxgi (0xf3000 bytes).\n2026-05-28 18:32:08,770 [root] DEBUG: 11832: DLL loaded at 0x00007FFF92740000: C:\\Windows\\System32\\d3d11 (0x263000 bytes).\n2026-05-28 18:32:08,778 [root] DEBUG: 11832: DLL loaded at 0x00007FFF87A50000: C:\\Windows\\System32\\WININET (0x4d6000 bytes).\n2026-05-28 18:32:08,779 [root] DEBUG: 11832: DLL loaded at 0x00007FFF7C210000: C:\\Windows\\System32\\windows.internal.shell.broker (0xdd000 bytes).\n2026-05-28 18:32:08,791 [root] DEBUG: 11832: DLL loaded at 0x00007FFF7D000000: C:\\Windows\\System32\\PCShellCommonProxyStub (0x13000 bytes).\n2026-05-28 18:32:08,810 [root] DEBUG: 11832: DLL loaded at 0x00007FFF96220000: C:\\Windows\\System32\\USERENV (0x2e000 bytes).\n2026-05-28 18:32:08,812 [root] DEBUG: 11832: DLL loaded at 0x00007FFF8B3C0000: C:\\Windows\\System32\\Bcp47Langs (0x5b000 bytes).\n2026-05-28 18:32:08,813 [root] DEBUG: 11832: DLL loaded at 0x00007FFF81F70000: C:\\Windows\\System32\\StartTileData (0x58a000 bytes).\n2026-05-28 18:32:18,876 [root] INFO: Process with pid 11832 has terminated\n2026-05-28 18:32:18,877 [root] DEBUG: 11832: NtTerminateProcess hook: Attempting to dump process 11832\n2026-05-28 18:32:18,879 [root] DEBUG: 11832: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 18:32:29,346 [root] DEBUG: 7284: DLL loaded at 0x00007FFF82E60000: C:\\Windows\\System32\\Windows.System.UserProfile.DiagnosticsSettings (0x15000 bytes).\n2026-05-28 18:32:29,480 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 8148: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:32:29,481 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 8148\n2026-05-28 18:32:29,482 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 8148\n2026-05-28 18:32:47,779 [root] DEBUG: 5020: DLL loaded at 0x00007FFF7FB70000: C:\\Windows\\system32\\wbem\\ncprov (0x21000 bytes).\n2026-05-28 18:32:48,680 [root] DEBUG: 8372: NtTerminateProcess hook: Attempting to dump process 8372\n2026-05-28 18:32:48,681 [root] DEBUG: 8372: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 18:32:48,699 [root] INFO: Process with pid 8372 has terminated\n2026-05-28 18:32:52,957 [root] DEBUG: 840: CreateProcessHandler: Injection info set for new process 3704: C:\\Windows\\system32\\DllHost.exe, ImageBase: 0x00007FF7BDF50000\n2026-05-28 18:32:52,959 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 3704\n2026-05-28 18:32:52,960 [lib.api.process] INFO: Monitor config for process 3704: C:\\2unxg6vp\\dll\\3704.ini\n2026-05-28 18:32:52,962 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:52,964 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:52,970 [root] DEBUG: Loader: Injecting process 3704 (thread 3808) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:52,971 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:52,975 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:52,976 [lib.api.process] INFO: Injected into 64-bit <Process 3704 dllhost.exe>\n2026-05-28 18:32:52,978 [root] INFO: Announced 64-bit process name: dllhost.exe pid: 3704\n2026-05-28 18:32:52,978 [lib.api.process] INFO: Monitor config for process 3704: C:\\2unxg6vp\\dll\\3704.ini\n2026-05-28 18:32:52,979 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:52,981 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:52,987 [root] DEBUG: Loader: Injecting process 3704 (thread 3808) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:52,988 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:52,988 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:52,990 [lib.api.process] INFO: Injected into 64-bit <Process 3704 dllhost.exe>\n2026-05-28 18:32:52,999 [root] DEBUG: 3704: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:32:53,000 [root] DEBUG: 3704: Interactive desktop enabled.\n2026-05-28 18:32:53,000 [root] DEBUG: 3704: Dropped file limit defaulting to 100.\n2026-05-28 18:32:53,003 [root] DEBUG: 3704: Disabling sleep skipping.\n2026-05-28 18:32:53,004 [root] DEBUG: 3704: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:32:53,016 [root] DEBUG: 3704: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:32:53,017 [root] DEBUG: 3704: YaraScan: Scanning 0x00007FF7BDF50000, size 0x8026\n2026-05-28 18:32:53,018 [root] DEBUG: 3704: Monitor initialised: 64-bit capemon loaded in process 3704 at 0x00007FFF52E70000, thread 3808, image base 0x00007FF7BDF50000, stack from 0x0000009287FD4000-0x0000009287FE0000\n2026-05-28 18:32:53,019 [root] DEBUG: 3704: Commandline: C:\\Windows\\system32\\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}\n2026-05-28 18:32:53,038 [root] DEBUG: 3704: hook_api: LdrpCallInitRoutine export address 0x00007FFF98C699BC obtained via GetFunctionAddress\n2026-05-28 18:32:53,077 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 18:32:53,080 [root] DEBUG: 3704: set_hooks: Unable to hook LockResource\n2026-05-28 18:32:53,086 [root] DEBUG: 3704: Hooked 627 out of 628 functions\n2026-05-28 18:32:53,087 [root] DEBUG: 3704: Syscall hook installed, syscall logging level 1\n2026-05-28 18:32:53,092 [root] DEBUG: 3704: RestoreHeaders: Restored original import table.\n2026-05-28 18:32:53,093 [root] INFO: Loaded monitor into process with pid 3704\n2026-05-28 18:32:53,093 [root] DEBUG: 3704: caller_dispatch: Added region at 0x00007FF7BDF50000 to tracked regions list (ntdll::NtAllocateVirtualMemory returns to 0x00007FF7BDF512F2, thread 3808).\n2026-05-28 18:32:53,094 [root] DEBUG: 3704: YaraScan: Scanning 0x00007FF7BDF50000, size 0x8026\n2026-05-28 18:32:53,095 [root] DEBUG: 3704: ProcessImageBase: Main module image at 0x00007FF7BDF50000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:32:53,097 [root] DEBUG: 3704: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:32:53,098 [root] DEBUG: 3704: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 18:32:53,101 [root] DEBUG: 3704: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:32:53,123 [root] DEBUG: 3704: DLL loaded at 0x00007FFF93CF0000: C:\\Windows\\system32\\uxtheme (0x9e000 bytes).\n2026-05-28 18:32:53,139 [root] DEBUG: 3704: DLL loaded at 0x00007FFF95800000: C:\\Windows\\system32\\logoncli (0x43000 bytes).\n2026-05-28 18:32:53,140 [root] DEBUG: 3704: DLL loaded at 0x00007FFF95850000: C:\\Windows\\system32\\netutils (0xc000 bytes).\n2026-05-28 18:32:53,141 [root] DEBUG: 3704: DLL loaded at 0x00007FFF8EAB0000: C:\\Windows\\system32\\dhcpcsvc (0x1d000 bytes).\n2026-05-28 18:32:53,143 [root] DEBUG: 3704: DLL loaded at 0x00007FFF90780000: C:\\Windows\\system32\\WINHTTP (0x10a000 bytes).\n2026-05-28 18:32:53,144 [root] DEBUG: 3704: DLL loaded at 0x00007FFF95450000: C:\\Windows\\SYSTEM32\\ntmarta (0x33000 bytes).\n2026-05-28 18:32:53,144 [root] DEBUG: 3704: DLL loaded at 0x00007FFF984B0000: C:\\Windows\\System32\\shcore (0xad000 bytes).\n2026-05-28 18:32:53,145 [root] DEBUG: 3704: DLL loaded at 0x00007FFF956F0000: C:\\Windows\\system32\\IPHLPAPI (0x3b000 bytes).\n2026-05-28 18:32:53,146 [root] DEBUG: 3704: DLL loaded at 0x00007FFF96220000: C:\\Windows\\system32\\USERENV (0x2e000 bytes).\n2026-05-28 18:32:53,146 [root] DEBUG: 3704: DLL loaded at 0x00007FFF96260000: C:\\Windows\\system32\\profapi (0x25000 bytes).\n2026-05-28 18:32:53,147 [root] DEBUG: 3704: DLL loaded at 0x00007FFF91E70000: C:\\Windows\\system32\\XmlLite (0x36000 bytes).\n2026-05-28 18:32:53,149 [root] DEBUG: 3704: DLL loaded at 0x00007FFF95730000: C:\\Windows\\system32\\DNSAPI (0xca000 bytes).\n2026-05-28 18:32:53,150 [root] DEBUG: 3704: DLL loaded at 0x00007FFF3A0B0000: C:\\Windows\\system32\\domgmt (0x86000 bytes).\n2026-05-28 18:32:53,152 [root] DEBUG: 3704: DLL loaded at 0x00007FFF98020000: C:\\Windows\\System32\\NSI (0x8000 bytes).\n2026-05-28 18:32:53,158 [root] DEBUG: 3704: DLL loaded at 0x00007FFF874D0000: C:\\Windows\\System32\\OneCoreCommonProxyStub (0x7f000 bytes).\n2026-05-28 18:32:53,648 [root] DEBUG: 840: CreateProcessHandler: Injection info set for new process 8032: C:\\Windows\\System32\\mousocoreworker.exe, ImageBase: 0x00007FF6D47B0000\n2026-05-28 18:32:53,649 [root] INFO: Announced 64-bit process name: MoUsoCoreWorker.exe pid: 8032\n2026-05-28 18:32:53,650 [lib.api.process] INFO: Monitor config for process 8032: C:\\2unxg6vp\\dll\\8032.ini\n2026-05-28 18:32:53,651 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:53,654 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:53,660 [root] DEBUG: Loader: Injecting process 8032 (thread 4572) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:53,661 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:53,662 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:53,663 [lib.api.process] INFO: Injected into 64-bit <Process 8032 MoUsoCoreWorker.exe>\n2026-05-28 18:32:53,664 [root] INFO: Announced 64-bit process name: MoUsoCoreWorker.exe pid: 8032\n2026-05-28 18:32:53,665 [lib.api.process] INFO: Monitor config for process 8032: C:\\2unxg6vp\\dll\\8032.ini\n2026-05-28 18:32:53,665 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:53,667 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:53,671 [root] DEBUG: Loader: Injecting process 8032 (thread 4572) with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:53,672 [root] DEBUG: InjectDllViaIAT: Successfully patched IAT.\n2026-05-28 18:32:53,672 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:53,674 [lib.api.process] INFO: Injected into 64-bit <Process 8032 MoUsoCoreWorker.exe>\n2026-05-28 18:32:53,694 [root] DEBUG: 8032: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:32:53,695 [root] DEBUG: 8032: Interactive desktop enabled.\n2026-05-28 18:32:53,696 [root] DEBUG: 8032: Dropped file limit defaulting to 100.\n2026-05-28 18:32:53,700 [root] DEBUG: 8032: VerifyCodeSection: Exception rebasing image from 0x00007FF6D47B0000 to 0x0000000140000000.\n2026-05-28 18:32:53,703 [root] DEBUG: 8032: Disabling sleep skipping.\n2026-05-28 18:32:53,705 [root] DEBUG: 8032: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:32:53,716 [root] DEBUG: 8032: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:32:53,717 [root] DEBUG: 8032: YaraScan: Scanning 0x00007FF6D47B0000, size 0x1ad000\n2026-05-28 18:32:53,728 [root] DEBUG: 8032: Monitor initialised: 64-bit capemon loaded in process 8032 at 0x00007FFF52E70000, thread 4572, image base 0x00007FF6D47B0000, stack from 0x0000003FA3D54000-0x0000003FA3D60000\n2026-05-28 18:32:53,728 [root] DEBUG: 8032: Commandline: C:\\Windows\\System32\\mousocoreworker.exe -Embedding\n2026-05-28 18:32:53,740 [root] DEBUG: 8032: hook_api: LdrpCallInitRoutine export address 0x00007FFF98C699BC obtained via GetFunctionAddress\n2026-05-28 18:32:53,762 [root] WARNING: b'Unable to create trampoline for LockResource, hook type 2'\n2026-05-28 18:32:53,763 [root] DEBUG: 8032: set_hooks: Unable to hook LockResource\n2026-05-28 18:32:53,776 [root] DEBUG: 8032: Hooked 627 out of 628 functions\n2026-05-28 18:32:53,792 [root] DEBUG: 8032: Syscall hook installed, syscall logging level 1\n2026-05-28 18:32:53,797 [root] DEBUG: 8032: RestoreHeaders: Restored original import table.\n2026-05-28 18:32:53,798 [root] INFO: Loaded monitor into process with pid 8032\n2026-05-28 18:32:53,809 [root] DEBUG: 8032: caller_dispatch: Added region at 0x00007FF6D47B0000 to tracked regions list (ntdll::LdrGetDllHandle returns to 0x00007FF6D48D1219, thread 4572).\n2026-05-28 18:32:53,810 [root] DEBUG: 8032: YaraScan: Scanning 0x00007FF6D47B0000, size 0x1ad000\n2026-05-28 18:32:53,822 [root] DEBUG: 8032: ProcessImageBase: Main module image at 0x00007FF6D47B0000 unmodified (entropy change 0.000000e+00)\n2026-05-28 18:32:53,826 [root] DEBUG: 8032: DLL loaded at 0x00007FFF94210000: C:\\Windows\\SYSTEM32\\kernel.appcore (0x12000 bytes).\n2026-05-28 18:32:53,828 [root] DEBUG: 8032: DLL loaded at 0x00007FFF96C20000: C:\\Windows\\System32\\bcryptPrimitives (0x82000 bytes).\n2026-05-28 18:32:53,856 [root] DEBUG: 8032: CreateThreadBreakpoints: Failed to open thread and get a handle.\n2026-05-28 18:32:53,882 [root] DEBUG: 8032: DLL loaded at 0x00007FFF98230000: C:\\Windows\\System32\\clbcatq (0xa9000 bytes).\n2026-05-28 18:32:53,901 [root] DEBUG: 8032: DLL loaded at 0x00007FFF7DE30000: C:\\Windows\\System32\\usocoreps (0xd000 bytes).\n2026-05-28 18:32:54,131 [root] DEBUG: 8032: DLL loaded at 0x00007FFF90780000: C:\\Windows\\System32\\WINHTTP (0x10a000 bytes).\n2026-05-28 18:32:54,134 [root] DEBUG: 8032: DLL loaded at 0x00007FFF960B0000: C:\\Windows\\System32\\DPAPI (0xa000 bytes).\n2026-05-28 18:32:54,135 [root] DEBUG: 8032: DLL loaded at 0x00007FFF392B0000: C:\\Windows\\System32\\UPShared (0xb2000 bytes).\n2026-05-28 18:32:54,142 [root] DEBUG: 8032: DLL loaded at 0x00007FFF80CA0000: C:\\Windows\\System32\\wuapi (0xf0000 bytes).\n2026-05-28 18:32:54,144 [root] DEBUG: 8032: DLL loaded at 0x00007FFF93940000: C:\\Windows\\SYSTEM32\\wups (0x1a000 bytes).\n2026-05-28 18:32:54,146 [root] DEBUG: 8032: DLL loaded at 0x00007FFF91FE0000: C:\\Windows\\SYSTEM32\\wtsapi32 (0x14000 bytes).\n2026-05-28 18:32:54,149 [root] DEBUG: 8032: DLL loaded at 0x00007FFF95FF0000: C:\\Windows\\System32\\WINSTA (0x5b000 bytes).\n2026-05-28 18:32:54,254 [root] DEBUG: 8032: DLL loaded at 0x00007FFF93940000: C:\\Windows\\System32\\wups (0x1a000 bytes).\n2026-05-28 18:32:54,591 [root] DEBUG: 4676: DLL loaded at 0x00007FFF38EE0000: C:\\Windows\\System32\\wscinterop (0x3d000 bytes).\n2026-05-28 18:32:54,594 [root] DEBUG: 4676: DLL loaded at 0x00007FFF869C0000: C:\\Windows\\System32\\WSCAPI (0x4d000 bytes).\n2026-05-28 18:32:54,602 [root] DEBUG: 4676: DLL loaded at 0x00007FFF38EC0000: C:\\Windows\\System32\\wscui.cpl (0x19000 bytes).\n2026-05-28 18:32:54,606 [root] DEBUG: 4676: DLL loaded at 0x00007FFF3A6D0000: C:\\Windows\\System32\\framedynos (0x52000 bytes).\n2026-05-28 18:32:54,608 [root] DEBUG: 4676: DLL loaded at 0x00007FFF94030000: C:\\Windows\\System32\\wer (0xde000 bytes).\n2026-05-28 18:32:54,609 [root] DEBUG: 4676: DLL loaded at 0x00007FFF38DE0000: C:\\Windows\\System32\\werconcpl (0xde000 bytes).\n2026-05-28 18:32:54,636 [root] DEBUG: 4676: DLL loaded at 0x00007FFF38DC0000: C:\\Windows\\System32\\hcproviders (0x14000 bytes).\n2026-05-28 18:32:54,648 [root] DEBUG: 4676: DLL loaded at 0x00007FFF38CD0000: C:\\Windows\\System32\\ieproxy (0xee000 bytes).\n2026-05-28 18:32:56,114 [root] DEBUG: 8032: api-cap: NtClose hook disabled due to count: 5000\n2026-05-28 18:32:58,173 [root] INFO: Process with pid 3704 has terminated\n2026-05-28 18:32:58,175 [root] DEBUG: 3704: NtTerminateProcess hook: Attempting to dump process 3704\n2026-05-28 18:32:58,176 [root] DEBUG: 3704: DoProcessDump: Skipping process dump as code is identical on disk.\n2026-05-28 18:32:58,495 [root] DEBUG: 8032: DLL loaded at 0x00007FFF953C0000: C:\\Windows\\System32\\msvcp110_win (0x8a000 bytes).\n2026-05-28 18:32:58,496 [root] DEBUG: 8032: DLL loaded at 0x00007FFF90020000: C:\\Windows\\SYSTEM32\\policymanager (0xa1000 bytes).\n2026-05-28 18:32:58,504 [root] DEBUG: 8032: DLL loaded at 0x00007FFF3A110000: C:\\Windows\\System32\\usoapi (0x26000 bytes).\n2026-05-28 18:32:58,505 [root] DEBUG: 8032: DLL loaded at 0x00007FFF80EB0000: C:\\Windows\\System32\\FlightSettings (0xe6000 bytes).\n2026-05-28 18:32:58,508 [root] DEBUG: 8032: DLL loaded at 0x00007FFF82B00000: C:\\Windows\\System32\\Windows.Networking.Connectivity (0xb9000 bytes).\n2026-05-28 18:32:58,511 [root] DEBUG: 8032: DLL loaded at 0x00007FFF8E350000: C:\\Windows\\System32\\npmproxy (0x10000 bytes).\n2026-05-28 18:32:58,517 [root] DEBUG: 8032: DLL loaded at 0x00007FFF92180000: C:\\Windows\\System32\\WinTypes (0x155000 bytes).\n2026-05-28 18:32:58,525 [root] DEBUG: 8032: DLL loaded at 0x00007FFF7D020000: C:\\Windows\\SYSTEM32\\productenumerator (0xe000 bytes).\n2026-05-28 18:32:58,928 [root] INFO: Stopping Task Scheduler Service\n2026-05-28 18:32:58,943 [root] INFO: Stopped Task Scheduler Service\n2026-05-28 18:32:58,951 [root] INFO: Starting Task Scheduler Service\n2026-05-28 18:32:58,966 [root] INFO: Started Task Scheduler Service\n2026-05-28 18:32:58,968 [lib.api.process] INFO: Monitor config for process 1384: C:\\2unxg6vp\\dll\\1384.ini\n2026-05-28 18:32:58,971 [lib.api.process] INFO: Option 'interactive' with value '1' sent to monitor\n2026-05-28 18:32:58,977 [lib.api.process] INFO: 64-bit DLL to inject is C:\\2unxg6vp\\dll\\qmRoKOe.dll, loader C:\\2unxg6vp\\bin\\eOrEOjSc.exe\n2026-05-28 18:32:58,983 [root] DEBUG: Loader: Injecting process 1384 with C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:58,985 [root] DEBUG: 1384: Python path set to 'C:\\Users\\admin\\AppData\\Local\\Python\\pythoncore-3.14-64'.\n2026-05-28 18:32:58,987 [root] DEBUG: 1384: Disabling sleep skipping.\n2026-05-28 18:32:58,989 [root] DEBUG: 1384: Interactive desktop enabled.\n2026-05-28 18:32:58,990 [root] DEBUG: 1384: Dropped file limit defaulting to 100.\n2026-05-28 18:32:58,994 [root] DEBUG: 1384: Services hook set enabled\n2026-05-28 18:32:58,997 [root] DEBUG: 1384: YaraInit: Compiled rules loaded from existing file C:\\2unxg6vp\\data\\yara\\capemon.yac\n2026-05-28 18:32:59,014 [root] DEBUG: 1384: RtlInsertInvertedFunctionTable 0x00007FFF98C6090E, LdrpInvertedFunctionTableSRWLock 0x00007FFF98DBD4F0\n2026-05-28 18:32:59,015 [root] DEBUG: 1384: Monitor initialised: 64-bit capemon loaded in process 1384 at 0x00007FFF52E70000, thread 13104, image base 0x00007FF71F590000, stack from 0x000000173BDF4000-0x000000173BE00000\n2026-05-28 18:32:59,016 [root] DEBUG: 1384: Commandline: C:\\Windows\\system32\\svchost.exe -k netsvcs -p -s Schedule\n2026-05-28 18:32:59,028 [root] DEBUG: 1384: Hooked 69 out of 69 functions\n2026-05-28 18:32:59,030 [root] INFO: Loaded monitor into process with pid 1384\n2026-05-28 18:32:59,034 [root] DEBUG: InjectDllViaThread: Successfully injected Dll into process via RtlCreateUserThread.\n2026-05-28 18:32:59,036 [root] DEBUG: Successfully injected DLL C:\\2unxg6vp\\dll\\qmRoKOe.dll.\n2026-05-28 18:32:59,039 [lib.api.process] INFO: Injected into 64-bit <Process 1384 svchost.exe>\n2026-05-28 18:32:59,459 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94E40000: C:\\Windows\\SYSTEM32\\sppc (0x25000 bytes).\n2026-05-28 18:32:59,460 [root] DEBUG: 7284: DLL loaded at 0x00007FFF94E70000: C:\\Windows\\system32\\slc (0x29000 bytes).\n2026-05-28 18:32:59,461 [root] DEBUG: 7284: DLL loaded at 0x00007FFF391C0000: C:\\Windows\\system32\\slwga (0x19000 bytes).\n2026-05-28 18:32:59,476 [root] DEBUG: 7284: DLL loaded at 0x00007FFF391A0000: C:\\Windows\\System32\\Windows.System.Diagnostics.Telemetry.PlatformTelemetryClient (0x12000 bytes).\n2026-05-28 18:32:59,551 [root] DEBUG: 7284: CreateProcessHandler: Injection info set for new process 13228: C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe, ImageBase: 0x00007FF6F9430000\n2026-05-28 18:32:59,552 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 13228\n2026-05-28 18:32:59,554 [root] DEBUG: 7284: ProcessMessage: Skipping monitoring process 13228\n2026-05-28 18:32:59,691 [root] DEBUG: 7284: DLL loaded at 0x00007FFF39030000: C:\\Windows\\System32\\CloudExperienceHostCommon (0x128000 bytes).\n2026-05-28 18:33:00,080 [root] INFO: Announced starting service \"b'BITS'\"\n2026-05-28 18:33:01,054 [root] DEBUG: 8032: DLL loaded at 0x00007FFF913D0000: C:\\Windows\\System32\\taskschd (0xac000 bytes).\n2026-05-28 18:33:01,108 [root] INFO: Announced starting service \"b'WaaSMedicSvc'\"\n2026-05-28 18:33:02,141 [root] DEBUG: 8032: DLL loaded at 0x0000018CEB640000: C:\\Windows\\system32\\WaaSMedicPS (0xc000 bytes).\n2026-05-28 18:33:02,285 [lib.common.results] INFO: Uploading file C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal to files\\237c6c609dce209c2cbaaace9f781120c6935b987fc61fc6fc2ecc5ea9c4892b; Size is 8720; Max size: 100000000\n2026-05-28 18:33:02,319 [lib.common.results] INFO: Uploading file C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal to files\\80ef5df696bf1f3c09c36b276d4bc0a81d7a1e83e970c10d466fd42ce5f239e2; Size is 8720; Max size: 100000000\n2026-05-28 18:33:02,386 [lib.common.results] INFO: Uploading file C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal to files\\866fe1662e0c3fac01b71d4b39b0f0bee2d7411e841de5b85c19741d1af11d90; Size is 8720; Max size: 100000000\n2026-05-28 18:33:02,409 [lib.common.results] INFO: Uploading file C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal to files\\5459aaa7b94b326d2321e6e5a992ca0a4a9d36780f94b66fac585854ed582f5a; Size is 8720; Max size: 100000000\n2026-05-28 18:33:02,437 [lib.common.results] INFO: Uploading file C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal to files\\418e6950457c5d3dc17c89249ac7da769bbbcbf2247411e8898f511f45c65624; Size is 8720; Max size: 100000000\n2026-05-28 18:33:02,572 [lib.common.results] INFO: Uploading file C:\\ProgramData\\USOPrivate\\UpdateStore\\store.db-journal to files\\e910871b6e02883f21522e53168ffe0a267f7e309af573325892e5a1f1eed49d; Size is 12824; Max size: 100000000\n",
    "errors": []
  },
  "network": {},
  "url": {
    "whois": "Name: None\nCountry: None\nState: None\nCity: None\nZIP Code: None\nAddress: None\n\nOrginization: None\nDomain Name(s):\n    SUGARCRAFT.NET\nCreation Date:\n    2026-04-13 16:52:11\nUpdated Date:\n    2026-04-13 17:06:24\nExpiration Date:\n    2027-04-13 16:52:11\nEmail(s):\n    abuse-tracker@hostinger.com\n\nRegistrar(s):\n    HOSTINGER operations, UAB\nName Server(s):\n    DNS23.HOSTWARE.COM.TR\n    DNS24.HOSTWARE.COM.TR\nReferral URL(s):\n    None",
    "virustotal": {
      "error": true,
      "msg": "Unable to complete connection to VirusTotal. Status code: 429"
    }
  },
  "target": {
    "category": "url"
  },
  "url_analysis": {
    "url": "https://sugarcraft.net/"
  },
  "procmemory": [],
  "signatures": [
    {
      "name": "queries_computer_name",
      "description": "Queries computer hostname",
      "categories": [
        "system_discovery"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8032,
          "cid": 16245
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16250
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16265
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16276
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16280
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16286
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16293
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16297
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16303
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "queries_keyboard_layout",
      "description": "Queries the keyboard layout",
      "categories": [
        "location_discovery"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 309
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 312
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 481
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 492
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 592
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 617
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 738
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 859
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 866
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 968
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3514
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3825
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 310
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 313
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 479
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 490
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 591
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 616
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 736
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 858
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 864
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 933
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 714
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "queries_locale_api",
      "description": "Queries the computer locale (possible geofencing)",
      "categories": [
        "location_discovery",
        "geofence"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 173
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 396
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 867
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 876
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 878
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 883
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 895
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 898
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 900
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 903
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 905
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 907
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 909
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 912
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 914
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 916
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 918
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 921
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 924
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 927
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 929
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 931
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 934
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 936
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 939
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 942
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 944
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 947
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 950
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 953
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 956
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 959
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 962
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 965
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 970
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 972
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 976
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 978
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 981
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 983
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 985
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 987
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 990
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 993
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 995
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 997
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1000
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1002
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1004
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1006
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1009
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1011
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1013
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1015
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1213
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1216
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1218
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1220
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1222
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1225
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1248
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1250
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1252
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1254
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1269
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1284
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1286
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1288
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1290
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1314
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1316
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1320
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1322
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1324
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1326
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1328
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1444
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1446
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1448
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1450
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1460
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1468
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1471
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1473
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1492
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1555
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1558
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1560
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1562
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1564
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1567
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1597
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1603
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1605
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1607
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3504
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3508
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3513
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3524
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3526
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3529
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3532
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3535
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3538
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3541
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3544
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3547
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3549
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3551
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3553
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3555
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3558
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3561
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3563
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3566
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3568
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3571
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3574
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3577
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3580
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3582
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3587
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3589
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3591
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3594
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3597
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3599
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3601
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3604
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3607
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3610
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3612
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3615
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3618
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3620
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3623
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3626
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3629
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3631
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3633
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3635
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3638
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3641
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3644
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3646
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3649
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3652
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3655
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3658
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3660
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3662
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3664
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3667
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3670
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3673
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3676
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3678
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3680
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3682
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3685
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3688
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3691
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3694
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3697
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3700
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3703
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3706
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3709
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3712
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3714
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3716
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3718
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3721
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3724
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3726
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3729
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3732
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3735
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3738
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3741
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3744
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3746
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3748
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3750
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3752
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3755
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3757
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3760
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3763
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3766
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3768
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3770
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3773
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3776
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3779
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3782
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3784
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3787
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3790
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3793
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3795
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3798
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3800
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3802
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3819
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3822
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3829
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 173
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 396
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 869
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 878
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 880
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 885
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 910
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 912
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 914
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 917
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 919
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 921
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 923
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 935
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 937
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1069
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1109
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1112
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1114
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1116
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1118
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1121
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1144
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1146
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1148
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1150
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1165
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1181
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1184
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1186
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1188
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1212
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1214
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1218
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1220
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1222
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1224
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1226
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1342
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1344
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1346
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1348
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1358
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1366
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1369
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1371
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1390
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1452
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1455
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1457
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1459
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1461
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1464
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1494
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1500
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1502
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1504
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3394
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3398
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3403
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3405
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16251
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16272
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16281
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16289
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16298
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 16306
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "accesses_public_folder",
      "description": "A file was accessed within the Public folder.",
      "categories": [
        "generic"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "file": "C:\\Users\\Public\\Desktop\\%1"
        },
        {
          "file": "C:\\Users\\Public\\Desktop"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "antidebug_setunhandledexceptionfilter",
      "description": "SetUnhandledExceptionFilter detected (possible anti-debug)",
      "categories": [
        "anti-debug"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 40,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 75
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "stealth_timeout",
      "description": "Possible date expiration check, exits too soon after checking local time",
      "categories": [
        "stealth"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 40,
      "references": [],
      "data": [
        {
          "process": "dllhost.exe, PID 3704"
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 792
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "language_check_registry",
      "description": "Checks system language via registry key (possible geofencing)",
      "categories": [
        "location_discovery",
        "geofence"
      ],
      "severity": 1,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\CustomLocale\\en-US"
        },
        {
          "regkey": "HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Nls\\ExtendedLocale\\en-US"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "mouse_movement_detect",
      "description": "Checks for mouse movement",
      "categories": [
        "anti-sandbox"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 7
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 503
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 875
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 877
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 897
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 899
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 902
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 904
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 906
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 908
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 911
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 913
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 915
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 917
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 919
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 920
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 922
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 923
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 925
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 926
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 928
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 930
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 932
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 933
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 935
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 937
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 938
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 940
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 941
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 943
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 945
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 946
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 948
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 949
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 951
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 952
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 954
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 955
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 957
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 958
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 960
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 961
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 963
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 964
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 966
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 971
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 973
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 975
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 977
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 980
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 982
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 984
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 986
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 988
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 989
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 991
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 992
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 994
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 996
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 998
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 999
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1001
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1003
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1005
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1007
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1008
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1010
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1012
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1014
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3525
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3527
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3528
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3530
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3531
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3533
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3534
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3536
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3537
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3539
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3540
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3542
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3543
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3545
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3546
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3548
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3550
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3552
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3554
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3556
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3557
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3559
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3560
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3562
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3564
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3565
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3567
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3569
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3570
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3572
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3573
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3575
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3576
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3578
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3579
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3581
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3585
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3586
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3588
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3590
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3592
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3593
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3595
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3596
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3598
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3600
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3602
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3603
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3605
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3606
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3608
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3609
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3611
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3613
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3614
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3616
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3617
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3619
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3621
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3622
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3624
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3625
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3627
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3628
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3630
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3632
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3634
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3636
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3637
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3639
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3640
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3642
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3643
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3645
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3647
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3648
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3650
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3651
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3653
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3654
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3656
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3657
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3659
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3661
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3663
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3665
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3666
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3668
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3669
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3671
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3672
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3674
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3675
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3677
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3679
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3681
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3683
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3684
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3686
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3687
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3689
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3690
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3692
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3693
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3695
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3696
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3698
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3699
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3701
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3702
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3704
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3705
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3707
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3708
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3710
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3711
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3713
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3715
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3717
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3719
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3720
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3722
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3723
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3725
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3727
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3728
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3730
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3731
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3733
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3734
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3736
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3737
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3739
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3740
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3742
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3743
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3745
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3747
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3749
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3751
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3753
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3754
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3756
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3758
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3759
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3761
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3762
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3764
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3765
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3767
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3769
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3771
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3772
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3774
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3775
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3777
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3778
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3780
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3781
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3783
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3785
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3786
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3788
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3789
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3791
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3792
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3794
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3796
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3797
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3799
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3801
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 7
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 501
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 877
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 879
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 916
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 918
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 920
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 922
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 924
        },
        {
          "mouse_movement": "Checks for mouse movement (mouse movement observed in sandbox during sampling)."
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "privilege_elevation_check",
      "description": "Queries process token information to check for Administrator privileges or UAC elevation status",
      "categories": [
        "discovery",
        "privilege_escalation"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 146
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 147
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 146
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 147
        },
        {
          "type": "call",
          "pid": 10576,
          "cid": 139
        },
        {
          "type": "call",
          "pid": 10576,
          "cid": 140
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 883
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3368
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3369
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3665
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 4030
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 4031
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 69
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 70
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 168
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 169
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "query_fips_reconnaissance",
      "description": "Queried the FIPS cryptography policy, can be used to adapt C2 network encryption or by legitimate encryption software",
      "categories": [
        "discovery",
        "c2"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 10576,
          "cid": 97
        },
        {
          "type": "call",
          "pid": 10576,
          "cid": 98
        },
        {
          "type": "call",
          "pid": 10576,
          "cid": 101
        },
        {
          "type": "call",
          "pid": 10576,
          "cid": 103
        },
        {
          "type": "call",
          "pid": 10576,
          "cid": 104
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 49
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 50
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 53
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 55
        },
        {
          "type": "call",
          "pid": 3704,
          "cid": 56
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 109
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 110
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 113
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 115
        },
        {
          "type": "call",
          "pid": 8032,
          "cid": 116
        },
        {
          "behavioral_fips_reconnaissance": [
            "mousocoreworker.exe (PID: 8032) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "WmiPrvSE.exe (PID: 10576) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'",
            "WmiPrvSE.exe (PID: 10576) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "WmiPrvSE.exe (PID: 10576) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "dllhost.exe (PID: 3704) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\STE'",
            "dllhost.exe (PID: 3704) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'",
            "dllhost.exe (PID: 3704) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "dllhost.exe (PID: 3704) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "dllhost.exe (PID: 3704) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "mousocoreworker.exe (PID: 8032) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\Enabled'",
            "mousocoreworker.exe (PID: 8032) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy\\MDMEnabled'",
            "WmiPrvSE.exe (PID: 10576) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "mousocoreworker.exe (PID: 8032) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "mousocoreworker.exe (PID: 8032) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\SYSTEM\\ControlSet001\\Control\\Lsa\\FipsAlgorithmPolicy'",
            "WmiPrvSE.exe (PID: 10576) probed FIPS encryption policy at 'HKEY_LOCAL_MACHINE\\System\\CurrentControlSet\\Control\\Lsa\\FipsAlgorithmPolicy'"
          ]
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "mountpoints_volume_discovery",
      "description": "Queries the mount points and then resolves volume paths to enumerate storage devices",
      "categories": [
        "discovery",
        "ransomware",
        "wiper"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 20,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 11832,
          "cid": 3574
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3579
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3590
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3650
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3656
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3671
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3698
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3704
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3711
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3719
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3725
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3728
        },
        {
          "type": "call",
          "pid": 11832,
          "cid": 3734
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "dllload_suspicious_directory",
      "description": "A DLL was loaded from a suspicious directory",
      "categories": [
        "side loading"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 7284,
          "cid": 119
        },
        {
          "suspicious_dll_load": "Process msedge.exe loaded a DLL from a suspicious directory, this is possibly indicative of DLL side loading/search order hijacking"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "registers_vectored_exception_handler",
      "description": "Registers a vectored exception handler (VEH), possibly to hijack execution flow",
      "categories": [
        "evasion",
        "execution",
        "injection"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 11832,
          "cid": 166
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "creates_suspended_process",
      "description": "Creates a process in a suspended state, likely for injection",
      "categories": [
        "injection",
        "process hollowing"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 50,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 4676,
          "cid": 143
        },
        {
          "type": "call",
          "pid": 4676,
          "cid": 318
        },
        {
          "type": "call",
          "pid": 7284,
          "cid": 104
        },
        {
          "type": "call",
          "pid": 7284,
          "cid": 105
        },
        {
          "type": "call",
          "pid": 7284,
          "cid": 115
        },
        {
          "type": "call",
          "pid": 7284,
          "cid": 116
        },
        {
          "type": "call",
          "pid": 7284,
          "cid": 135
        },
        {
          "type": "call",
          "pid": 7284,
          "cid": 137
        },
        {
          "type": "call",
          "pid": 7284,
          "cid": 178
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "resumethread_remote_process",
      "description": "Resumed a thread in another process",
      "categories": [
        "injection",
        "unpacking"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "thread_resumed": "Process explorer.exe with process ID 4676 resumed a thread in another process with the process ID 8372"
        },
        {
          "type": "call",
          "pid": 4676,
          "cid": 168
        },
        {
          "type": "call",
          "pid": 4676,
          "cid": 324
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "discover_registry_mount_points",
      "description": "Queries registry mount points to identify historical or connected removable/network drives",
      "categories": [
        "discovery",
        "ransomware",
        "wiper"
      ],
      "severity": 2,
      "weight": 1,
      "confidence": 20,
      "references": [],
      "data": [
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Generation"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Data"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-100000000000}\\Generation"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\Data"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{e32a94c0-5af2-11f1-ae2c-806e6f6e6963}\\"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Generation"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\Data"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Generation"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-300300000000}\\Data"
        },
        {
          "mount_point_key": "HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{528c102f-0000-0000-0000-c0dd0e000000}\\"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "antisandbox_unhook",
      "description": "Tries to unhook or modify Windows functions monitored by CAPE",
      "categories": [
        "anti-sandbox"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 60,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 11832,
          "cid": 4596
        },
        {
          "unhook": "function_name: CommandLineToArgvW, type: restored"
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "hardware_id_profiling",
      "description": "Queries the Volume Serial Number or Physical Hardware ID, possibly for anti-sandbox, victim profiling or environmental keying",
      "categories": [
        "evasion",
        "recon",
        "anti-sandbox"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 3354
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3368
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3382
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3244
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3258
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3272
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "antivm_wmi",
      "description": "Executes WMI queries that can be used for anti-virtualization",
      "categories": [
        "anti-vm"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 80,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 1180
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1270
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1297
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1343
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 1538
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3487
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1076
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1166
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1195
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1241
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 1435
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3377
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    },
    {
      "name": "suspicious_iocontrol_codes",
      "description": "Uses suspicious IO control codes, indicative of disk enumeration or a bootkit/wiper",
      "categories": [
        "bootkit",
        "rootkit",
        "wiper"
      ],
      "severity": 3,
      "weight": 1,
      "confidence": 100,
      "references": [],
      "data": [
        {
          "type": "call",
          "pid": 8372,
          "cid": 3354
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3355
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3359
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3360
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3368
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3369
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3373
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3374
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3382
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3383
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3387
        },
        {
          "type": "call",
          "pid": 8372,
          "cid": 3388
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3244
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3245
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3249
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3250
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3258
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3259
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3263
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3264
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3272
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3273
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3277
        },
        {
          "type": "call",
          "pid": 2380,
          "cid": 3278
        }
      ],
      "new_data": [],
      "alert": false,
      "families": []
    }
  ],
  "malscore": 10.0,
  "ttps": [
    {
      "signature": "mouse_movement_detect",
      "ttps": [
        "T1497"
      ],
      "mbcs": []
    },
    {
      "signature": "antisandbox_unhook",
      "ttps": [
        "T1562.001",
        "T1562"
      ],
      "mbcs": [
        "OB0001",
        "B0003",
        "OB0006",
        "F0004",
        "F0004.003"
      ]
    },
    {
      "signature": "hardware_id_profiling",
      "ttps": [
        "T1082"
      ],
      "mbcs": [
        "E1082",
        "E1480.001"
      ]
    },
    {
      "signature": "antivm_wmi",
      "ttps": [
        "T1497",
        "T1082",
        "T1047"
      ],
      "mbcs": [
        "B0001.002",
        "B0007",
        "OB0001"
      ]
    },
    {
      "signature": "suspicious_iocontrol_codes",
      "ttps": [
        "T1542.003"
      ],
      "mbcs": []
    },
    {
      "signature": "privilege_elevation_check",
      "ttps": [
        "T1033",
        "T1082"
      ],
      "mbcs": []
    },
    {
      "signature": "query_fips_reconnaissance",
      "ttps": [
        "T1082"
      ],
      "mbcs": []
    },
    {
      "signature": "mountpoints_volume_discovery",
      "ttps": [
        "T1082"
      ],
      "mbcs": []
    },
    {
      "signature": "dllload_suspicious_directory",
      "ttps": [
        "T1574"
      ],
      "mbcs": [
        "F0015"
      ]
    },
    {
      "signature": "registers_vectored_exception_handler",
      "ttps": [
        "T1055",
        "T1574"
      ],
      "mbcs": []
    },
    {
      "signature": "creates_suspended_process",
      "ttps": [
        "T1055"
      ],
      "mbcs": []
    },
    {
      "signature": "resumethread_remote_process",
      "ttps": [
        "T1055"
      ],
      "mbcs": []
    },
    {
      "signature": "accesses_public_folder",
      "ttps": [
        "T1548",
        "T1036"
      ],
      "mbcs": []
    },
    {
      "signature": "discover_registry_mount_points",
      "ttps": [
        "T1082"
      ],
      "mbcs": []
    }
  ],
  "malstatus": "Malicious"
}